CVE-2026-75841: Medium severity ArcadeDB vulnerability
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ArcadeDB deployments running a version before 26.8.1 are affected. Exploitation requires an authenticated user account capable of submitting Cypher queries.
What is required to trigger the issue?
An attacker submits a Cypher range() expression with excessively large bounds. The expression can exhaust server heap memory, causing an OutOfMemoryError and temporary degradation or loss of availability.
What is the available remediation?
Upgrade ArcadeDB to version 26.8.1 or later. The provided information does not identify an alternative mitigation for environments where an upgrade cannot be performed immediately.