CVE-2026-63015

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]

https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
Apache Software FoundationApache InLong>= 2.0.0, < 2.4.0

References

Timeline

Published
Aug 20, 2026
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-630165.3Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-officiCVE-2026-630179.0Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administraCVE-2026-630184.8Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software before version 1.16.18CVE-2026-63028.8Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-630203.1A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages  Impact: CVE-2026-630216.5Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before readiCVE-2026-630275.3Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allowCVE-2026-630285.1Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: HyperviCVE-2026-63038.8Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via aCVE-2026-630309.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the CVE-2026-630336.5A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddCVE-2026-630358.1A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial
CVE-2026-63015: Medium severity, CVSS 4.3 | Vulnix