CVE-2026-18852
Received Received - Intake

Improper Input Validation in Epsilla Cloud VectorDB

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulDB

Description
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18852

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
epsilla-cloud vectordb to 0.3.18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18852 is a flaw in the epsilla-cloud vectordb filter parser up to version 0.3.18. It involves improper handling of malformed filter expressions, such as an unmatched closing parenthesis like '2)e+'. This causes the ShuntingYard function to incorrectly pop an empty operator stack, leading to program termination under sanitizer or hardened runtime conditions.

Detection Guidance

To detect this vulnerability, you can test the affected VectorDB filter parser by sending malformed expressions like '2)e+' to the system. If the service crashes or behaves abnormally, it may indicate the presence of this flaw. Use tools like curl to send test queries to the database endpoint.

Impact Analysis

This vulnerability allows a local attacker to cause a denial of service by crashing the VectorDB application when processing a specially crafted filter expression. It does not directly lead to data breaches or code execution but disrupts service availability.

Mitigation Strategies

Immediately update epsilla-cloud vectordb to a version beyond 0.3.18. If an update is unavailable, restrict local access to the vulnerable component and implement input validation for filter expressions to reject malformed syntax like unmatched parentheses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18852. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart