CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Merged summary · from the lead articleSummaries by Vani AI
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
CVE-2026-108837 is a low-severity resource-allocation flaw in Apache Kylin 4.0.0 through 5.0.4. A user who already has project-admin permission can use a cache API to exhaust resources associated with computed columns. Apache recommends upgrading to 5.0.5; no exploitation is reported.
Key facts
- Project-admin access is required to trigger the cache API issue.
- Affected releases are Apache Kylin 4.0.0 through 5.0.4.
- Apache rates the flaw low and fixes it in 5.0.5.
- Vendors
- Apache
- Products
- Apache Kylin
- Organizations
- Apache Software Foundation
Coverage
oldest first · one row per article · UTC- · 14d ago
oss-securityFirst report
CVE-2026-108833: Apache Kylin: default startup profile miss security settings
Apache Kylin’s default startup profile omits security settings in versions 4.0.0 through 5.0.4.
- · 14d ago
CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108833 | Default startup profile miss security settings in Apache Kylin | — | — | ||
| CVE-2026-108837 | Allocation of resources without limits or throttling vulnerability in Apache Kylin | — | — |