CVE-2021-31522: Apache Kylin

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Affected products

• Apache Kylin: from 2.0.0, up to and including 2.6.6; from 3.0.0, before 3.1.3 (fixed in 3.1.3); version 4.0.0 only

Published 2022-01-06. Last modified 2026-06-17.