CVE-2025-61735

HighCVSS 7.3/10Last modified Oct 12, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
Apache Software FoundationApache Kylin>= 4.0.0, <= 5.0.2

References

Timeline

Published
Oct 2, 2025
Last modified
Oct 12, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-617367.1Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expiresCVE-2025-617382.3Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.CVE-2025-617397.2Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.CVE-2025-61746.1The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter beforeCVE-2025-617407.2Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or moCVE-2025-617483.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LibrariCVE-2025-617492.7Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitaCVE-2025-61757.2Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issueCVE-2025-617504.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affecteCVE-2025-617518.1Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comCVE-2025-617527.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areCVE-2025-617536.1Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected a
CVE-2025-61735: High severity, CVSS 7.3 | Vulnix