CVE-2026-75841

MEDIUM 4.3

ArcadeDB before 26.8.1 Denial of Service via range()

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.

CWE	CWE-770
Vendor	arcadedata
Product	arcadedb
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for arcadedata arcadedb

Be the first to know when new medium vulnerabilities affecting arcadedata arcadedb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

ArcadeData / arcadedb

0 < 26.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778 vulncheck.com: https://www.vulncheck.com/advisories/arcadedb-before-denial-of-service-via-range

Credits

🔍 shulei5831sl