Cyber ·
CVE-2026-108837: Apache Kylin may suffer resource exhaustion in calculated columns
Low-severity advisory on Apache Kylin: a project administrator can use a cache API to exhaust resources of calculated columns in versions 4.0.0 through 5.0.4. The fix is in version 5.0.5.
The Radar records a security advisory published on October 16, 2026, identified as CVE-2026-108837, about Apache Kylin. According to the text, a user with project administrator permission can use a cache API to exhaust resources of calculated columns. The issue affects versions 4.0.0 through 5.0.4 and is rated low severity. The advisory describes the cause as unbounded resource allocation without adequate control. The text recommends upgrading to version 5.0.5, which fixes the problem. The original post was made by Li Yang on October 15 on the oss-sec list. The Radar item is an automatic translation of the feed content and is truncated where the description continues. To verify the details, consult the original post on the oss-sec list and the official Apache Kylin documentation. Anyone running Kylin instances should confirm the installed version and plan the upgrade. Relevance to personal or organizational data depends on who holds project administrator roles, so it is worth reviewing those permissions.