Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-6948
PUBLISHED
More InfoOfficial Page
Assigner-rapid7
Assigner Org ID-9974b330-7714-4307-a722-5648477acda7
View Known Exploited Vulnerability (KEV) details
Published At-03 May, 2026 | 23:55
Updated At-04 May, 2026 | 13:08
Rejected At-
▼CVE Numbering Authority (CNA)
Unbounded Memory Allocation in VQLResponse Result-Set Writer

Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.

Affected Products
Vendor
Rapid7 LLCRapid7
Product
Velociraptor
Repo
https://github.com/Velocidex/velociraptor
Platforms
  • Linux
Default Status
unaffected
Versions
Affected
  • From 0 before 0.76.4 (custom)
  • From 0 before 0.75.9 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-770CWE-770 Allocation of resources without limits or throttling
Type: CWE
CWE ID: CWE-770
Description: CWE-770 Allocation of resources without limits or throttling
Metrics
VersionBase scoreBase severityVector
3.14.9MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 4.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-130CAPEC-130 Excessive Allocation
CAPEC ID: CAPEC-130
Description: CAPEC-130 Excessive Allocation
Solutions

To remediate, you will need to  upgrade your server https://www.velociraptor-docs.org/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade  to the latest version of your release: * For 0.76 releases, upgrade immediately to  v0.76.4 https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.4-linux-amd64 * For 0.75 releases, upgrade immediately to  v0.75.9 https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.9-linux-amd64

Configurations
Workarounds
Exploits
Credits
finder
We thank Faisal Alhumaid (Faisal.alhumaid@hotmail.com) for reporting this issue responsibly.
finder
We also thank Mika Jarvinen (mika.jarvinen@kapsi.fi) for reporting this issue responsibly at the same time.
Timeline
EventDate
Initial report by Faisal Alhumaid2026-04-19 14:00:00
Initial report by Mika Jarvinen2026-04-19 14:00:00
Advisory published and patch distributed2026-04-27 23:50:00
Event: Initial report by Faisal Alhumaid
Date: 2026-04-19 14:00:00
Event: Initial report by Mika Jarvinen
Date: 2026-04-19 14:00:00
Event: Advisory published and patch distributed
Date: 2026-04-27 23:50:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/
N/A
Hyperlink: https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found