Apache Kylin allows allocation of resources without limits or throttling when a cache API is used by a project administrator. This exploitation can consume excessive memory, CPU or other system resources, potentially causing the platform to become unresponsive or crash. The type of weakness is a resource exhaustion vulnerability, classified under CWE‑770.

The vulnerability affects Apache Kylin versions from 4.0.0 through 5.0.4, distributed by the Apache Software Foundation.

The EPSS score is not publicly available and the vulnerability is not listed in the CISA KEV catalog. Because the attacker must possess project administrator privileges, the attack vector is limited to environments where such permissions exist or are compromised. Once the cache API is invoked repeatedly, the platform may exhaust available resources, leading to a denial‑of‑service condition. The severity could be high if the system services critical business processes.