As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
CVE-2026-64610 affects Apache Kylin versions 4.0.0 through 5.0.4 and involves unsafe Java deserialization when handling data from an external cache service. The vulnerability carries moderate severity and is resolved in version 5.0.5.
Why it matters: Organizations running Apache Kylin 4.x or 5.x before 5.0.5 should patch immediately, as unsafe deserialization from a cache service can lead to remote code execution if an attacker compromises or intercepts the cache.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
CVE-2026-64610 is an unsafe Java deserialization vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 that can be triggered when the application receives data from a compromised external cache service. The vulnerability carries a CVSS 3.1 score of 9.8. Apache Kylin 5.0.5 and later address the issue.
Why it matters: Organizations running Apache Kylin 4.0.0 to 5.0.4 should upgrade immediately to 5.0.5 to eliminate the risk of remote code execution if their Redis cache becomes compromised or accessible to attackers.
- Source published
- First seen by Cybersecurity Tracker