CVE-2026-6948 describes a resource exhaustion vulnerability (CWE-770) in Rapid7 Velociraptor server versions before 0.76.4. The vulnerability exists in the agent control channel, where a malicious or compromised client can send specially crafted messages that cause the server to consume excessive memory, leading to an out-of-memory condition and server crash. This results in denial of service without affecting data confidentiality or integrity. There is no vendor advisory or patch information available at this time.

The vulnerability allows denial of service by crashing the Velociraptor server through out-of-memory conditions triggered by crafted client messages. It does not impact confidentiality or integrity of data. The server becomes unavailable until restarted or recovered, potentially disrupting incident response or monitoring operations relying on Velociraptor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or monitoring client access to the Velociraptor server to trusted entities only to reduce risk of exploitation.