CVE-2026-108837 — Apache Kylin: Potential computed-column resource exhaustion

CVE-2026-108837

Apache Kylin: Potential computed-column resource exhaustion PUBLISHED

Description (CNA)

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Kylin	affected 4.0.0 through 5.0.4

CWE

CWE-770

References

https://lists.apache.org/thread.html/qgpgkx6zh37tlys28qlysrffo6pz614v

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/10/16/21