Description
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.



This issue affects Apache Kylin: from 4.0.0 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Published: 2026-10-19
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion leading to Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Apache Kylin allows allocation of resources without limits or throttling when a cache API is used by a project administrator. This exploitation can consume excessive memory, CPU or other system resources, potentially causing the platform to become unresponsive or crash. The type of weakness is a resource exhaustion vulnerability, classified under CWE‑770.

Affected Systems

The vulnerability affects Apache Kylin versions from 4.0.0 through 5.0.4, distributed by the Apache Software Foundation.

Risk and Exploitability

The EPSS score is 0.0017 and the vulnerability is not listed in the CISA KEV catalog. Because the attacker must possess project administrator privileges, the attack vector is limited to environments where such permissions exist or are compromised. Once the cache API is invoked repeatedly, the platform may exhaust available resources, leading to a denial‑of‑service condition. The severity is high, as reflected by a CVSS score of 7.5, which indicates significant impact on availability.

Generated by OpenCVE AI on November 4, 2026 at 14:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Kylin to version 5.0.5, which contains the fix for the resource exhaustion bug.
  • Restrict project administrator privileges to trusted users or enforce role‑based access controls to minimize the possibility of malicious use of the cache API.
  • Monitor system resource usage on Kylin clusters and set alerts for abnormal memory or CPU consumption to detect and mitigate potential exhaustion incidents.

Generated by OpenCVE AI on November 4, 2026 at 14:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Kylin
Apache Software Foundation
Apache Software Foundation apache Kylin
Vendors & Products Apache
Apache apache Kylin
Apache Software Foundation
Apache Software Foundation apache Kylin

Mon, 19 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
References

Mon, 19 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Title Apache Kylin: Potential computed-column resource exhaustion
Weaknesses CWE-770
References

Subscriptions

Apache Apache Kylin
Apache Software Foundation Apache Kylin
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-03T22:33:20.553Z

Reserved: 2026-10-11T11:55:17.431Z

Link: CVE-2026-108837

cve-icon Vulnrichment

Updated: 2026-10-19T10:12:03.537Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T10:16:45.220

Modified: 2026-11-03T23:17:25.517

Link: CVE-2026-108837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T14:15:15Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling