CVE-2026-64610 - Vulnerability Details - OpenCVE

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/5jwj20t50wc6x9pw0zmlj8tzfl37dpry

History

Fri, 16 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
Title		Apache Kylin: Redis unsafe Java deserialization
Weaknesses		CWE-502
References		https://lists.apache.org/thread.html/5jwj20t50wc6x9pw0zmlj8tzfl37dpry

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-10-16T12:13:18.802Z

Updated: 2026-10-16T12:15:16.013Z

Reserved: 2026-07-20T09:43:18.782Z

Link: CVE-2026-64610

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64610", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-20T09:43:18.782Z", "datePublished": "2026-10-16T12:13:18.802Z", "dateUpdated": "2026-10-16T12:15:16.013Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-16T12:13:18.802Z"}, "title": "Apache Kylin: Redis unsafe Java deserialization", "problemTypes": [{"descriptions": [{"description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "cweId": "CWE-502", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Kylin", "versions": [{"status": "affected", "version": "4..0.0", "lessThanOrEqual": "5.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Deserialization of Untrusted Data vulnerability in Apache Kylin.\u00a0Unsafe Java deserialization could happen from a broken external cache service.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.</p><p>This issue affects Apache Kylin: from 4 through 5.0.4.</p><p>Users are recommended to upgrade to version 5.0.5, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/5jwj20t50wc6x9pw0zmlj8tzfl37dpry", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Andrew Ridings <[email protected]>", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/16/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-16T12:15:16.013Z"}}]}}