Is CVE-2026-75841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75841 being exploited in the wild.

How severe is CVE-2026-75841?

Medium severity, with a CVSS score of 4.3, published 18 August 2026.

Which products and versions are affected?

ArcadeData ArcadeDB before 26.8.1.

Is there a fix for CVE-2026-75841?

A patch was published on 2026-08-18: Fix available in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75841 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75841?

Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75841: ArcadeDB Cypher range() denial of service via heap exhaustion

CVE-2026-75841 · Severity: medium · CVSS 4.3 · Published 2026-08-18

ArcadeDB is a multi-model database used for graph, document, and search workloads. An authenticated attacker can submit specially crafted Cypher queries with oversized range() expressions, causing the server to allocate excessive heap memory and trigger an OutOfMemoryError. This results in temporary service unavailability and degraded performance for legitimate users, with potential for broader impact if multiple requests are sent concurrently.

Technologies: ArcadeData ArcadeDB. Vendors: ArcadeData.

Quick answers

Is CVE-2026-75841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75841 being exploited in the wild.
How severe is CVE-2026-75841?: Medium severity, with a CVSS score of 4.3, published 18 August 2026.
Which products and versions are affected?: ArcadeData ArcadeDB before 26.8.1.
Is there a fix for CVE-2026-75841?: A patch was published on 2026-08-18: Fix available in version 26.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75841 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75841?: Check whether you run ArcadeData ArcadeDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-770) in ArcadeDB's Cypher query engine. The range() function materializes the complete output into a Java ArrayList without validating that the requested range cardinality is feasible for the configured heap. An authenticated user can execute a query like RETURN range(0, 9999999999) AS v to allocate ~10 billion integers, triggering java.lang.OutOfMemoryError during ArrayList expansion. The attack requires network access and authentication privileges to execute arbitrary Cypher queries. No user interaction is required. A single request causes temporary service degradation; concurrent or repeated requests may achieve broader denial of service. The fix (available in version 26.8.1) likely implements pre-execution cardinality limits or lazy evaluation of range results.

Affected products

ArcadeData ArcadeDB before 26.8.1

Timeline

2026-08-04: disclosed: GitHub Security Advisory GHSA-xmjm-8q85-g778 published
2026-08-18: advisory: CVE-2026-75841 published on NVD
2026-08-18: patched: Fix available in version 26.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.