CVE-2026-75841 in ArcadeDB
Summary
by MITRE • 08/18/2026
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within ArcadeDB versions prior to 26.8.1, specifically affecting the implementation of the Cypher query language's range function. This vulnerability is classified as a denial of service condition that stems from insufficient resource management during the processing of specific input parameters. The core technical issue involves the way the database engine allocates memory for array generation when handling large numerical bounds in range expressions. When an authenticated user submits a request containing excessively large start and end values, the system attempts to instantiate a collection or iterator encompassing all integers within that vast interval. This operation triggers a rapid consumption of server heap memory as the underlying Java Virtual Machine tries to allocate space for millions or billions of elements, ultimately leading to an OutOfMemoryError exception.
From a technical perspective, this vulnerability represents a classic case of resource exhaustion due to unbounded input processing. The flaw allows attackers who possess valid authentication credentials to manipulate the internal state of the database server by forcing it into a memory-intensive computation path that was not adequately constrained or validated for reasonable limits. Unlike vulnerabilities that allow remote code execution or data exfiltration, this specific defect is designed solely to disrupt availability. By repeatedly triggering these oversized range queries, an attacker can systematically deplete the available heap space of the database process. This leads to a state where the server becomes unresponsive, crashes, or requires manual intervention and restarts to recover normal operations, thereby causing temporary service degradation or complete unavailability for other legitimate users relying on the same instance.
The operational impact of this vulnerability is significant in environments where ArcadeDB serves as a critical component of an application stack. Since authentication is required to exploit this flaw, it targets scenarios where user accounts are provisioned with query execution privileges but perhaps lack strict administrative oversight or rate limiting mechanisms. The resulting denial of service can lead to substantial downtime, loss of productivity for end-users accessing the database-driven applications, and potential data integrity risks if transactions were in progress during the crash. Furthermore, frequent restarts caused by such attacks can exacerbate wear on storage systems and complicate forensic analysis efforts due to log truncation or memory dump generation overheads.
To mitigate this risk, organizations running ArcadeDB versions earlier than 26.8.1 should prioritize upgrading to the latest patched release immediately. This update includes fixes that enforce stricter bounds checking and limit the maximum size of collections generated by range functions. In addition to patching, administrators should implement network-level access controls such as firewalls or API gateways to restrict Cypher query execution endpoints to trusted internal networks only. Implementing rate limiting on database connections can also help mitigate the impact of repeated malicious requests. Furthermore, configuring Java Virtual Machine heap size limits and monitoring memory usage metrics closely allows for early detection of anomalous spikes that may indicate an ongoing exploitation attempt. Aligning with industry standards, this vulnerability maps to CWE-400 Uncontrolled Resource Consumption and is relevant to ATT&CK technique T1499 Endpoint Denial of Service, highlighting the importance of robust input validation and resource governance in database management systems.