CVE-2026-75841

EUVD-2026-60605
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778
https://www.vulncheck.com/advisories/arcadedb-before-denial-of-service-via-range
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778