CVE-2026-75841
Received Received - Intake

Denial of Service in ArcadeDB via Cypher Range Function

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75841
EUVD
EUVD-2026-60605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
arcadedb arcadedb to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ArcadeDB before version 26.8.1 has a denial of service vulnerability in its Cypher range() function. Authenticated users can submit oversized range expressions with large bounds, causing the server to exhaust heap memory and trigger an OutOfMemoryError. This leads to temporary service degradation or unavailability.

Detection Guidance

Monitor for OutOfMemoryError logs in ArcadeDB server logs indicating heap exhaustion during Cypher range() function execution. Check for unusually large range() queries in query logs, such as those with bounds exceeding typical values (e.g., range(0, 9999999999)).

Use system monitoring tools to detect high memory usage patterns from ArcadeDB processes during query execution. Implement network traffic analysis to identify repeated or large payload queries targeting the range() function.

Impact Analysis

If exploited, this vulnerability can cause temporary service outages or slowdowns for ArcadeDB servers. Repeated or concurrent attacks may lead to broader availability issues, disrupting database operations and user access.

Compliance Impact

This vulnerability primarily impacts availability, which could indirectly affect compliance with standards like GDPR or HIPAA that require timely access to data. Repeated service disruptions or unavailability may lead to violations of availability requirements in these regulations.

Mitigation Strategies

Upgrade ArcadeDB to version 26.8.1 or later to apply the official patch addressing the range() function vulnerability.

Implement query execution limits or memory budgets for Cypher queries to prevent unbounded resource consumption. Restrict user permissions to execute large range() queries until mitigation is complete.

Enable query logging to track and block suspicious range() expressions with excessively large bounds. Consider deploying a web application firewall to filter malicious query patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart