CVE-2026-64951: Velociraptor DoS Vulnerability

CVE-2026-64951 Overview

CVE-2026-64951 is a divide-by-zero flaw [CWE-369] in the Velociraptor digital forensics and incident response platform. A rogue Velociraptor client can upload a malformed sparse file to the server. When a GUI operator later attempts to expand that file, the ShouldPadFile() function triggers a division by zero and panics. The panic can crash the server process, disrupting active investigations and data collection workflows.

The vulnerability requires an authenticated client and user interaction from a GUI operator. The impact is limited to availability. There is no confidentiality or integrity impact reported.

Critical Impact
A rogue client can crash the Velociraptor server process, interrupting incident response operations and forcing service restart.

Affected Products

Velociraptor DFIR platform (server component)
Deployments where untrusted or potentially compromised endpoints run the Velociraptor client
Multi-tenant Velociraptor environments where GUI operators triage client-uploaded artifacts

Discovery Timeline

2026-08-12 - CVE-2026-64951 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64951

Vulnerability Analysis

Velociraptor supports uploading sparse files from clients to the server. Sparse files represent large logical files efficiently by storing only non-empty regions and describing empty ranges through metadata. When the GUI expands such a file for viewing or download, Velociraptor uses the ShouldPadFile() function to determine whether padding should be inserted between data segments.

The function performs an arithmetic operation that divides by a value derived from client-supplied metadata. When that metadata is crafted to produce a zero divisor, the runtime raises a division-by-zero panic. Because the panic occurs on the server goroutine handling the GUI expansion, it can propagate and terminate the server process.

The outcome is a denial-of-service condition against the server. Ongoing collections, hunts, and analyst sessions are interrupted until the process restarts.

Root Cause

The root cause is missing input validation on sparse-file metadata prior to arithmetic in ShouldPadFile(). The function assumes a non-zero divisor without verifying the value supplied through the upload path. This is a classic instance of [CWE-369: Divide By Zero].

Attack Vector

The attacker requires an enrolled Velociraptor client. That client uploads a malformed sparse file with crafted index metadata. The condition triggers only when a GUI operator expands the file, so user interaction is required. The attack is network-reachable, low complexity, and requires low privileges. Refer to the Velociraptor Security Advisory CVE-2026-64951 for vendor details.

No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-64951

Indicators of Compromise

Unexpected Velociraptor server process crashes or restarts logged in service manager or systemd journals
Panic stack traces referencing ShouldPadFile in Velociraptor server logs
Sparse file uploads originating from clients that do not match expected collection activity
GUI session errors immediately preceding server termination

Detection Strategies

Ingest Velociraptor server logs into a centralized log platform and alert on Go runtime panic messages
Correlate client upload events with subsequent server restart events within short time windows
Baseline typical sparse file sizes and metadata patterns per client and flag statistical outliers

Monitoring Recommendations

Monitor Velociraptor server process uptime and restart counts through host telemetry
Track authentication and enrollment events for new or unusual client certificates
Alert on repeated GUI file-expansion actions that immediately precede service disruption

How to Mitigate CVE-2026-64951

Immediate Actions Required

Upgrade Velociraptor server to the fixed release identified in the vendor advisory
Audit enrolled clients and revoke certificates for any endpoints that are not fully trusted
Restrict GUI operator workflows to avoid expanding sparse files from unverified clients until patched
Ensure the Velociraptor service is configured to auto-restart to reduce downtime if the panic is triggered

Patch Information

Consult the Velociraptor Security Advisory CVE-2026-64951 for the specific fixed version and upgrade procedure. The fix adds validation in ShouldPadFile() to reject metadata that would cause a zero divisor.

Workarounds

Limit client enrollment to endpoints under direct administrative control until upgrade is complete
Avoid using the GUI file-expansion feature on sparse files from clients whose integrity is uncertain
Segment the Velociraptor server on a management network to reduce exposure to rogue clients

bash

# Verify the running Velociraptor server version and check for panics in logs
velociraptor version

# Linux - check for prior server panics referencing the vulnerable function
journalctl -u velociraptor-server | grep -Ei 'panic|ShouldPadFile'

# Ensure the systemd unit restarts the service on failure
sudo systemctl edit velociraptor-server
# Add under [Service]:
#   Restart=on-failure
#   RestartSec=5s