---
id: CVE-2026-64610
title: 'Apache Kylin: Redis unsafe Java deserialization'
summary: "Deserialization of Untrusted Data vulnerability in Apache Kylin.\_Unsafe Java deserialization could happen from a broken external cache service.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade…"
severity: none
cwe:
  - CWE-502
vendor: Apache Software Foundation
product: Apache Kylin
affected:
  - apache_kylin >= 4..0.0 <= 5.0.4
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T12:15:16.013Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64610'
references:
  - url: 'https://lists.apache.org/thread.html/5jwj20t50wc6x9pw0zmlj8tzfl37dpry'
tags:
  - cve.org
ingestedAt: '2026-10-16T13:06:42.680Z'
---

## Overview

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.



This issue affects Apache Kylin: from 4 through 5.0.4.



Users are recommended to upgrade to version 5.0.5, which fixes the issue.

## Affected

- `apache_kylin >= 4..0.0 <= 5.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.