~ / search / GHSA-f6m8-qm7j-fh65

GHSA-f6m8-qm7j-fh65

Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-61735

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.kylin:kylin >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-common-server >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-common-service >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-core-common >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-core-metadata >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-ops-server >= 4.0.0, < 5.0.3 5.0.3
Maven org.apache.kylin:kylin-server >= 4.0.0, < 5.0.3 5.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.