VulnerabilityDeferred

CVE-2026-108837

Allocation of resources without limits or throttling vulnerability in Apache Kylin.

UnscoredEPSS 0.17%

Does this matter?

Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.

Description

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS: Not yet scored
EPSS: 0.17% probability · 6th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-770
Source: security@apache.org

EPSS trend

EPSS moved from 0.2% on 20 October 2026 to 0.2% on 26 October 2026.

References

https://lists.apache.org/thread.html/qgpgkx6zh37tlys28qlysrffo6pz614v
http://www.openwall.com/lists/oss-security/2026/10/16/21

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.