CVE-2026-6948
Resource Exhaustion in Velociraptor Server via Agent Control Channel
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: Rapid7, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| velociraptor | velociraptor | to 0.76.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6948 is a medium-severity vulnerability in Velociraptor versions prior to 0.76.4 that involves unbounded memory allocation in the VQLResponse result-set writer.
This flaw allows a compromised or rogue Velociraptor client to crash the server by sending specially crafted messages through the normal client communication channel, causing the server to run out of memory (OOM).
How can this vulnerability impact me? :
The primary impact of this vulnerability is on the availability of the Velociraptor server.
An attacker with high privileges can exploit this vulnerability to crash the server by causing an out-of-memory condition, leading to denial of service.
There is no impact on confidentiality or integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are advised to upgrade Velociraptor to version 0.76.4 for the 0.76 release or version 0.75.9 for the 0.75 release.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability primarily impacts the availability of the Velociraptor server by allowing a compromised or rogue client to cause an out-of-memory (OOM) crash. There is no impact on confidentiality or integrity of data.
Since the vulnerability does not affect confidentiality or integrity, it does not directly compromise data protection requirements under standards like GDPR or HIPAA. However, the availability impact could affect service continuity, which may have indirect compliance implications depending on the specific regulatory requirements for system availability and uptime.