{"affected":[{"defaultStatus":"unaffected","product":"Apache Kylin","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"5.0.4","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-108837","cwes":["CWE-770"],"description":"Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","epss":{"date":"2026-11-03","percentile":0.06448,"score":0.0017},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793747845517,"publishedAt":1792401723856,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/qgpgkx6zh37tlys28qlysrffo6pz614v"},{"source":"ADP: CVE","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/16/21"},{"source":"security@apache.org","tags":[],"url":"https://lists.apache.org/thread.html/qgpgkx6zh37tlys28qlysrffo6pz614v"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"http://www.openwall.com/lists/oss-security/2026/10/16/21"}],"remediation":[],"revision":"a642bf8606de7c48903f34c4de3f7269606a4436888dfcf77bbb2990ceed3f88","sources":[{"modifiedAt":1793745200553,"name":"CNA: apache","retrievedAt":1793748158003,"url":"https://www.cve.org/CVERecord?id=CVE-2026-108837"},{"modifiedAt":1793747845517,"name":"NVD","retrievedAt":1793751456434,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108837"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748163584,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108837"}],"ssvc":{"assessedAt":1793740520194,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Kylin: Potential computed-column resource exhaustion","updatedAt":1793751456434}