Executive brief
ArcadeDB is a multi-model database used for graph, document, and search workloads. An authenticated attacker can submit specially crafted Cypher queries with oversized range() expressions, causing the server to allocate excessive heap memory and trigger an OutOfMemoryError. This results in temporary service unavailability and degraded performance for legitimate users, with potential for broader impact if multiple requests are sent concurrently.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-770) in ArcadeDB's Cypher query engine. The range() function materializes the complete output into a Java ArrayList without validating that the requested range cardinality is feasible for the configured heap. An authenticated user can execute a query like RETURN range(0, 9999999999) AS v to allocate ~10 billion integers, triggering java.lang.OutOfMemoryError during ArrayList expansion. The attack requires network access and authentication privileges to execute arbitrary Cypher queries. No user interaction is required. A single request causes temporary service degradation; concurrent or repeated requests may achieve broader denial of service. The fix (available in version 26.8.1) likely implements pre-execution cardinality limits or lazy evaluation of range results.
Affected products
- ArcadeData ArcadeDB before 26.8.1
Timeline
- 2026-08-04: disclosed: GitHub Security Advisory GHSA-xmjm-8q85-g778 published
- 2026-08-18: advisory: CVE-2026-75841 published on NVD
- 2026-08-18: patched: Fix available in version 26.8.1