Description
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ArcadeDB is vulnerable to a denial of service attack triggered by the Cypher range() function. Authenticated users can submit large range expressions that cause the JVM to throw an OutOfMemoryError, exhausting heap memory and leading to temporary service degradation or unavailability. The weakness is a classic resource exhaustion flaw (CWE‑770).

Affected Systems

All releases of ArcadeData ArcadeDB prior to version 26.8.1 are affected. The vulnerability exists in the Cypher query engine component that processes range() expressions.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity; EPSS data is absent and the vulnerability is not listed in the KEV catalog. Attackers must first authenticate to the server and then submit oversized range() queries. Once exploited, the server's heap memory is drained, causing a temporary denial of service that is mitigated only by restarting or recovering the memory.

Generated by OpenCVE AI on August 18, 2026 at 12:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest ArcadeDB release 26.8.1 or later to eliminate the memory exhaustion bug.
  • Restrict or disable the use of the range() function for non‑essential users and enforce least‑privilege access to Cypher queries.
  • Configure the JVM heap size limits and enable garbage‑collection monitoring to detect and recover from excessive memory usage.

Generated by OpenCVE AI on August 18, 2026 at 12:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Arcadedata
Arcadedata arcadedb
Vendors & Products Arcadedata
Arcadedata arcadedb

Tue, 18 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Title ArcadeDB before 26.8.1 Denial of Service via range()
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Arcadedata Arcadedb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-18T14:16:15.855Z

Reserved: 2026-08-18T10:59:33.701Z

Link: CVE-2026-75841

cve-icon Vulnrichment

Updated: 2026-08-18T14:15:43.816Z

cve-icon NVD

Status : Received

Published: 2026-08-18T12:19:34.463

Modified: 2026-08-18T15:17:14.540

Link: CVE-2026-75841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T14:00:13Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling