What’s Vulnerable › Vulnerabilities
CVE-2026-6948: Unbounded Memory Allocation in VQLResponse Result-Set Writer
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-04 · updated 2026-10-25
- Weakness: CWE-770
Description
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.
Affected products
- Rapid7 Velociraptor: before 0.76.4; before 0.75.9 — fixed in 0.75.9, 0.76.4
How to fix
Upgrade to a fixed version: Rapid7 Velociraptor 0.75.9, 0.76.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6948 or the next vulnerability affects your stack