CVE-2026-6948: Velociraptor Server DOS Vulnerability

CVE-2026-6948 Overview

CVE-2026-6948 is a resource exhaustion vulnerability affecting Velociraptor versions prior to 0.76.4. The flaw resides in the server's agent control channel, which handles client communications. A compromised or rogue Velociraptor client can send crafted messages through the standard communication channel to trigger an out-of-memory (OOM) condition on the server. The result is a server crash and disruption of digital forensics and incident response operations.

The weakness is classified under CWE-770: Allocation of Resources Without Limits or Throttling. Exploitation requires authenticated client access to the server, which limits the attacker pool but elevates risk in environments where any endpoint compromise can pivot to disable response tooling.

Critical Impact

A single rogue client can crash the central Velociraptor server, disabling fleet-wide visibility and incident response capabilities until the server is restarted.

Affected Products

• Velociraptor server versions prior to 0.76.4
• Deployments exposing the agent control channel to untrusted or potentially compromised clients
• All platforms running affected Velociraptor server builds

Discovery Timeline

• 2026-05-04 - CVE-2026-6948 published to NVD
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-6948

Vulnerability Analysis

Velociraptor is an open-source endpoint visibility and digital forensics platform. Clients (agents) communicate with the central server through a persistent control channel that exchanges queries, results, and telemetry. CVE-2026-6948 stems from missing limits on the size or rate of messages the server accepts on this channel.

When a client transmits crafted messages, the server allocates memory to parse and process them without enforcing upper bounds. Sustained or oversized input drives the server's resident memory until the operating system terminates the process or the host exhausts available memory. The condition affects only availability, not confidentiality or integrity.

Root Cause

The root cause is the absence of bounds checking and throttling on inbound client messages within the agent control channel. Server code paths responsible for deserializing or buffering client traffic allocate memory proportional to attacker-controlled input. Without quotas tied to client identity or message size, a single misbehaving client can monopolize server memory.

Attack Vector

Exploitation requires a Velociraptor client identity that can authenticate to the server. An adversary who has compromised an endpoint running the agent, or who has stolen client enrollment credentials, can replace or modify the client to emit malformed messages. Because the traffic uses the legitimate communication channel, network-layer controls do not block it. Refer to the Velociraptor Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-6948

Indicators of Compromise

• Velociraptor server processes terminating with OOM kill events recorded in dmesg or systemd journal logs
• Sudden, sustained memory growth on the Velociraptor server host without a corresponding increase in legitimate hunt activity
• Repeated reconnects from a single client GUID immediately preceding server crashes

Detection Strategies

• Monitor Velociraptor server logs for abnormal message volumes or oversized payloads originating from individual client GUIDs
• Alert on Linux OOM killer events targeting the velociraptor process via host telemetry or syslog forwarding
• Correlate client enrollment anomalies, such as duplicate or unexpected client identities, with server stability events

Monitoring Recommendations

• Track server memory utilization with thresholds that trigger before OOM conditions occur
• Forward Velociraptor server logs to a centralized SIEM and build dashboards for per-client message rates
• Establish a baseline of normal client-to-server traffic patterns to identify outliers quickly

How to Mitigate CVE-2026-6948

Immediate Actions Required

• Upgrade all Velociraptor server instances to version 0.76.4 or later as published in the vendor advisory
• Audit enrolled clients and revoke certificates for any agents that are decommissioned, untrusted, or unaccounted for
• Restrict network access to the agent control channel so only authorized client networks can reach the server

Patch Information

The vendor has fixed the issue in Velociraptor 0.76.4. Administrators should review the Velociraptor Security Advisory for upgrade instructions and verify the running server version after deployment.

Workarounds

• Apply operating system memory limits to the Velociraptor server process using systemd directives such as MemoryMax to contain runaway allocation
• Segment the Velociraptor server behind a reverse proxy or firewall that enforces connection rate limits per source
• Increase monitoring frequency on the server host so administrators can restart the service quickly if a crash occurs

# Example systemd override to cap Velociraptor server memory
# /etc/systemd/system/velociraptor_server.service.d/override.conf
[Service]
MemoryMax=8G
MemoryHigh=6G
Restart=always
RestartSec=5s