CVE-2026-6948 Unbounded Memory Allocation in VQLResponse Result-Set Writer
A compromised client can crash the Velociraptor server by sending crafted messages that cause unbounded memory allocation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6948?
CVE-2026-6948 is a medium-severity denial of service vulnerability in Rapid7 Velociraptor, published on 3 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.
This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.
Weakness: CWE-770
Which versions are affected by CVE-2026-6948?
How do I fix CVE-2026-6948?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-6948 being exploited?
There is no known exploitation of CVE-2026-6948 in the wild and no public exploit code.
Sources
Also known as GHSA-r3xq-q2q6-7vcc.