CVE-2026-6948 — Unbounded Memory Allocation in VQLResponse Result-Set Writer

CVE-2026-6948

Unbounded Memory Allocation in VQLResponse Result-Set Writer PUBLISHED

Description (CNA)

Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.76.4; affected 0 before 0.75.9

CWE

CWE-770

References

https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.