Description

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T12:19:34.463Z",
  "pubdate": "2026-08-18T12:19:34.463Z",
  "executiveSummary": "ArcadeDB before 26.8.1 suffers from a denial of service vulnerability residing in the Cypher query language engine's range() function. This flaw enables authenticated threat actors to exhaust the Java Virtual Machine heap memory allocation on the server hosting the database instance. By crafting and submitting intentionally oversized range() expressions utilizing excessively large upper and lower bounds, an attacker can directly trigger a fatal OutOfMemoryError condition within the runtime environment. The successful execution of this attack results in temporary service degradation, application crashes, or complete operational unavailability of the targeted database service. The risk implication is significant for environments where untrusted or semi-trusted users hold query execution privileges, as minimal attacker capabilities are required to disrupt business continuity. Exploitation strictly necessitates valid user authentication to interact with the Cypher query processing interface, allowing attackers to leverage standard query submission mechanisms to deliver the memory-exhausting payload without requiring elevated administrative privileges or complex exploit chains.",
  "technicalDetails": "The vulnerability is localized within the Cypher query processing component of ArcadeDB, specifically inside the implementation of the range() function. The root cause stems from insufficient input validation and bounds checking on numeric parameters supplied to the range() function. When processing a Cypher query containing an oversized range() expression with exorbitantly large bounds, the underlying database engine attempts to allocate memory structures or collections proportional to the requested numerical span in order to materialize the resulting sequence of values. Because the engine fails to enforce maximum size thresholds or resource allocation limits on the output collection, the execution of the query forces the Java Virtual Machine to attempt allocation of memory blocks that exceed the available heap space. This unchecked memory consumption directly leads to an unhandled OutOfMemoryError exception. The attack flow proceeds as follows: First, the authenticated attacker establishes a session with the ArcadeDB server and formulates a malicious Cypher query incorporating an extreme range() parameter, such as excessively wide start and end values. Second, the attacker transmits this query payload to the database endpoint via standard query execution protocols. Third, the ArcadeDB query parser and execution planner process the statement, invoking the vulnerable range() function. Fourth, the runtime environment attempts to generate the requested sequence, consuming all available heap memory. Fifth, the Java Virtual Machine triggers an OutOfMemoryError, which halts the affected thread or crashes the entire database process, inducing a denial of service state. This vulnerability affects all ArcadeDB versions prior to 26.8.1. Exploitation requires the attacker to possess authenticated access to the database query interface, but does not demand special privileges beyond the ability to execute Cypher statements. The attack vector is exposed wherever the Cypher interface is accessible to users over the network."
}