CVE-2026-75841: ArcadeDB before 26.8.1 Denial of Service via range()

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-770

Description

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.

Affected products

ArcadeData arcadedb: before 26.8.1 — fixed in 26.8.1

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.8.1. Check the vendor advisory for mitigations.

References

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778
https://www.vulncheck.com/advisories/arcadedb-before-denial-of-service-via-range
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778

Get alerted when CVE-2026-75841 or the next vulnerability affects your stack