CVE-2026-75841
ArcadeDB before 26.8.1 Denial of Service via range()
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 18, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 18, 2026
Description
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
arcadedbArcadeData |
|
References
- GitHub Security Advisory (GHSA-xmjm-8q85-g778)vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 Denial of Service via range()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.