{"api_version":"1","generated_at":"2026-05-04T12:31:43+00:00","cve":"CVE-2026-6948","urls":{"html":"https://cve.report/CVE-2026-6948","api":"https://cve.report/api/cve/CVE-2026-6948.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-6948","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-6948"},"summary":{"title":"Unbounded Memory Allocation in VQLResponse Result-Set Writer","description":"Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.\n\n\n\nThis allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.","state":"PUBLISHED","assigner":"rapid7","published_at":"2026-05-04 00:16:39","updated_at":"2026-05-04 00:16:39"},"problem_types":["CWE-770","CWE-770 CWE-770 Allocation of resources without limits or throttling"],"metrics":[{"version":"3.1","source":"cve@rapid7.com","type":"Secondary","score":"4.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/","name":"https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/","refsource":"cve@rapid7.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6948","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6948","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Rapid7","product":"Velociraptor","version":"affected 0.76.4 custom","platforms":["Linux"]},{"source":"CNA","vendor":"Rapid7","product":"Velociraptor","version":"affected 0.75.9 custom","platforms":["Linux"]}],"timeline":[{"source":"CNA","time":"2026-04-19T14:00:00.000Z","lang":"en","value":"Initial report by Faisal Alhumaid"},{"source":"CNA","time":"2026-04-19T14:00:00.000Z","lang":"en","value":"Initial report by Mika Jarvinen"},{"source":"CNA","time":"2026-04-27T23:50:00.000Z","lang":"en","value":"Advisory published and patch distributed"}],"solutions":[{"source":"CNA","title":"","value":"To remediate, you will need to  upgrade your server https://www.velociraptor-docs.org/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade  to the latest version of your release:\n\n  *  For 0.76 releases, upgrade immediately to  v0.76.4 https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64 \n  *  For 0.75 releases, upgrade immediately to  v0.75.9 https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"We thank Faisal Alhumaid (Faisal.alhumaid@hotmail.com) for reporting this issue responsibly.","lang":"en"},{"source":"CNA","value":"We also thank Mika Jarvinen (mika.jarvinen@kapsi.fi) for reporting this issue responsibly at the same time.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"Velociraptor","repo":"https://github.com/Velocidex/velociraptor","vendor":"Rapid7","versions":[{"lessThan":"0.76.4","status":"affected","version":"0","versionType":"custom"},{"lessThan":"0.75.9","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"We thank Faisal Alhumaid (Faisal.alhumaid@hotmail.com) for reporting this issue responsibly."},{"lang":"en","type":"finder","value":"We also thank Mika Jarvinen (mika.jarvinen@kapsi.fi) for reporting this issue responsibly at the same time."}],"datePublic":"2026-04-27T14:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.</p><p>This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.</p>"}],"value":"Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.\n\n\n\nThis allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel."}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","value":"CAPEC-130 Excessive Allocation"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of resources without limits or throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-03T23:55:40.555Z","orgId":"9974b330-7714-4307-a722-5648477acda7","shortName":"rapid7"},"references":[{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>To remediate, you will need to&nbsp;<a href=\"https://www.velociraptor-docs.org/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade\">upgrade your server</a>&nbsp;to the latest version of your release:</p><ul><li>For 0.76 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64\" target=\"_blank\">v0.76.4</a></li><li>For 0.75 releases, upgrade immediately to&nbsp;<a href=\"https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64\" target=\"_blank\">v0.75.9</a></li></ul>"}],"value":"To remediate, you will need to  upgrade your server https://www.velociraptor-docs.org/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade  to the latest version of your release:\n\n  *  For 0.76 releases, upgrade immediately to  v0.76.4 https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64 \n  *  For 0.75 releases, upgrade immediately to  v0.75.9 https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64"}],"source":{"advisory":"https://www.velociraptor-docs.org/announcements/advisories/cve-2","discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2026-04-19T14:00:00.000Z","value":"Initial report by Faisal Alhumaid"},{"lang":"en","time":"2026-04-19T14:00:00.000Z","value":"Initial report by Mika Jarvinen"},{"lang":"en","time":"2026-04-27T23:50:00.000Z","value":"Advisory published and patch distributed"}],"title":"Unbounded Memory Allocation in VQLResponse Result-Set Writer","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"9974b330-7714-4307-a722-5648477acda7","assignerShortName":"rapid7","cveId":"CVE-2026-6948","datePublished":"2026-05-03T23:55:40.555Z","dateReserved":"2026-04-24T03:35:48.568Z","dateUpdated":"2026-05-03T23:55:40.555Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-04 00:16:39","lastModifiedDate":"2026-05-04 00:16:39","problem_types":["CWE-770","CWE-770 CWE-770 Allocation of resources without limits or throttling"],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"6948","Ordinal":"1","Title":"Unbounded Memory Allocation in VQLResponse Result-Set Writer","CVE":"CVE-2026-6948","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"6948","Ordinal":"1","NoteData":"Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.\n\n\n\nThis allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.","Type":"Description","Title":"Unbounded Memory Allocation in VQLResponse Result-Set Writer"}]}}}