CVE-2026-64951 Velociraptor DoS triggered by Divide by Zero panic
A malicious client can crash the Velociraptor server by uploading a malformed sparse file that triggers a divide-by-zero panic during GUI expansion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-64951?
CVE-2026-64951 is a low-severity denial of service vulnerability in Rapid7 Velociraptor, published on 12 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.
The problem is a Divide by Zero bug in the ShouldPadFile() function.
Weakness: CWE-369
Which versions are affected by CVE-2026-64951?
How do I fix CVE-2026-64951?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64951 being exploited?
There is no known exploitation of CVE-2026-64951 in the wild and no public exploit code.
Sources
Also known as GHSA-frg5-mq2m-h39j.