Live › vulnerability › CVE-2026-108837
Go to dashboardApache Kylin versions 4.0.0 through 5.0.4 let a user with project admin permission call a cache API that triggers computed-column resource exhaustion. An attacker can degrade or crash the service by consuming memory or compute.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Kylin from 4.0.0 through 5.0.4 where users hold project admin permission. The exposure depends on an attacker already having project admin rights, so deployments with tightly limited admin roles are at lower risk. Installations on versions outside the affected range can skip it.
No product ranges from the sources yet.
4.0.0 through 5.0.4.5.0.5.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.
This issue affects Apache Kylin: from 4.0.0 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-108837")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.