EUVD-2026-60605
GHSA-5p5p-rm2x-6rvc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Cypher endpoint, authenticated access required (PR:L), temporary availability degradation only, no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
AnalysisAI
Heap memory exhaustion in ArcadeDB's Cypher query engine allows authenticated users to trigger OutOfMemoryError and cause temporary service unavailability. Attackers with valid database credentials can submit crafted Cypher range() expressions with abnormally large bounds, consuming server heap until the JVM is starved of resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with permission to execute Cypher queries against an ArcadeDB instance (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) reflects a medium-severity issue with a constrained real-world impact profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated database user - such as an application account, analyst, or compromised credential - submits a Cypher query containing range(0, 2147483647) or similarly large bounds to the ArcadeDB Cypher endpoint. The server attempts to materialize the full sequence in heap memory, rapidly exhausting available JVM heap and throwing an OutOfMemoryError, rendering the database temporarily unresponsive to all other users. … |
| Remediation | Upgrade ArcadeDB to version 26.8.1 or later, as confirmed by the vendor advisory at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today