Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck
CVE-2026-75841ArcadeDB before 26.8.1 Denial of Service via range()
Medium 4.3
In plain English
A medium-severity resource allocation without limits in arcadedb from ArcadeData. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ArcadeData | arcadedb | 0 – before 26.8.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-xmjm-8q85-g778) vendor-advisory
- VulnCheck Advisory: ArcadeDB before 26.8.1 Denial of Service via range() third-party-advisory