CVE-2026-108837CWE-770denial-of-service

CVE-2026-108837

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00197 · 9.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread.html/qgpgkx6zh37tlys28qlysrffo6pz614v · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/21 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:22Z
    Apache Kylin: Potential computed-column resource exhaustion
    cvelistv5
  • 19 OCT 09:22Z
    Apache Kylin: Potential computed-column resource exhaustion
    cvelistv5