CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
CVE-2026-108837 is a low-severity resource-allocation flaw in Apache Kylin 4.0.0 through 5.0.4. A user who already has project-admin permission can use a cache API to exhaust resources associated with computed columns. Apache recommends upgrading to 5.0.5; no exploitation is reported.
- Project-admin access is required to trigger the cache API issue.
- Affected releases are Apache Kylin 4.0.0 through 5.0.4.
- Apache rates the flaw low and fixes it in 5.0.5.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-108837 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Li Yang on Oct 15 Severity: low Affected versions: - Apache Kylin 4.0.0 through 5.0.4 Description: Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. This issue is being...
This source does not provide full text. Read it at seclists.org.