CVE-2026-75841: ArcadeDB Cypher DOS Vulnerability

CVE-2026-75841 Overview

CVE-2026-75841 is a denial of service vulnerability in ArcadeDB versions before 26.8.1. The flaw exists in the Cypher range() function and allows authenticated users to exhaust server heap memory. Attackers submit oversized range() expressions with large numeric bounds, triggering an OutOfMemoryError in the Java Virtual Machine. Successful exploitation causes temporary service degradation or full unavailability of the database. The issue is tracked as an uncontrolled resource consumption weakness under [CWE-770].

Critical Impact
Authenticated attackers can render ArcadeDB unavailable by submitting a single crafted Cypher query, disrupting downstream applications that depend on the database.

Affected Products

ArcadeDB versions prior to 26.8.1
Deployments exposing the Cypher query interface to authenticated users
Multi-tenant ArcadeDB instances where low-privilege accounts can submit queries

Discovery Timeline

2026-08-18 - CVE-2026-75841 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75841

Vulnerability Analysis

ArcadeDB supports the Cypher query language for graph traversal and data manipulation. The Cypher range() function generates a list of integers between a start and end bound. ArcadeDB does not enforce upper limits on the size of the requested range before allocating memory. When a user submits a range() call with very large bounds, the engine attempts to materialize the full list on the JVM heap. The allocation exceeds available memory and throws an OutOfMemoryError, halting query processing threads and impacting concurrent operations.

The vulnerability requires authenticated access but no elevated privileges. Any account permitted to run Cypher queries can trigger the condition. Service impact ends once the process is restarted, but repeated exploitation causes sustained outages.

Root Cause

The root cause is missing input validation and resource limits on the range() function's bound parameters. The Cypher execution path accepts arbitrary long integer bounds and eagerly builds an in-memory collection. No pre-check compares the requested element count against configured heap ceilings or per-query resource quotas, aligning with the [CWE-770] pattern of allocation without throttling.

Attack Vector

Exploitation occurs over the network against the ArcadeDB query endpoint. An authenticated attacker sends a Cypher statement such as one that invokes range() with bounds spanning billions of integers. The server begins constructing the list and consumes heap memory until the JVM aborts the allocation. See the GitHub Security Advisory GHSA-xmjm-8q85-g778 and the VulnCheck Advisory: ArcadeDB DoS for additional technical context.

No verified proof-of-concept code is publicly available.
Refer to the vendor advisory for reproduction details.

Detection Methods for CVE-2026-75841

Indicators of Compromise

OutOfMemoryError entries in ArcadeDB server logs correlated with recent Cypher query submissions
Sudden JVM heap saturation followed by process termination or unresponsive query threads
Cypher queries in audit logs containing range() calls with unusually large numeric bounds

Detection Strategies

Enable Cypher query audit logging and inspect statements containing range( with bounds exceeding operational norms
Correlate application-level OutOfMemoryError events with the authenticated principal that submitted the preceding query
Baseline typical query heap consumption and alert on statements whose allocation profile deviates sharply

Monitoring Recommendations

Track JVM heap utilization, garbage collection frequency, and query latency for ArcadeDB instances
Monitor authentication logs for accounts submitting queries immediately before service restarts
Forward ArcadeDB and JVM logs to a centralized platform to preserve evidence across crashes and restarts

How to Mitigate CVE-2026-75841

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later, which addresses the unbounded range() allocation
Restrict Cypher query privileges to trusted service accounts until the upgrade is complete
Review recent query audit logs for exploitation attempts and identify implicated accounts

Patch Information

The issue is resolved in ArcadeDB 26.8.1. Consult the GitHub Security Advisory GHSA-xmjm-8q85-g778 for the fix commit and upgrade guidance. Coordinate the update with application owners to validate compatibility with existing Cypher workloads.

Workarounds

Limit database access to authenticated users whose queries are reviewed or parameterized by trusted application code
Place ArcadeDB behind a query proxy that rejects statements containing range() calls with bounds above a safe threshold
Configure JVM memory limits and per-query timeouts to shorten the impact window when large allocations occur

bash

# Example: restrict network exposure of ArcadeDB query endpoint to trusted hosts
iptables -A INPUT -p tcp --dport 2480 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2480 -j DROP