CVE-2026-75841
MediumCVSS 4.3Summary
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.
Risk Assessment
The attack can exhaust server memory, resulting in unavailability of the database for all users.
Recommendation
Update ArcadeDB to version 26.8.1 or later, which includes the fix.
Original NVD description (English source)
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.