CVE-2026-6948
Medium
Description
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.
SeverityMedium
CVSS4.9
Exploit probability—
ProductVelociraptor
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- Rapid7 Velociraptor0.76.4, 0.75.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Rapid7 Velociraptor | v < 0.76.4, v < 0.75.9 | 0.76.4, 0.75.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.