AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Rapid7CVE-2026-64951

A rogue Velociraptor client can upload a malformed sparse file such

Rapid7

CVE-2026-64951 · Published Aug 12, 2026 · updated Aug 28, 2026

Low3.5
Fix: upgrade to 0.77.2 or later
Rapid7 advisory

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.

The problem is a Divide by Zero bug in the ShouldPadFile() function.

Affected versions

PackageAffectedFixed in
Velociraptor
Product
< 0.77.20.77.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-369

More Rapid7 advisories

All Rapid7
Medium 6.5Aug 12Rapid7 Velociraptor: improper authorizationCVE-2026-64952fixed in 0.77.2Medium 6.1Aug 12Rapid7 Velociraptor: CSV injectionCVE-2026-64955fixed in 0.77.2Medium 6.5Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-18652fixed in 0.77.2High 8.2Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-64954fixed in 0.77.2Medium 6.5Aug 11Rapid7 Velociraptor: null pointer dereferenceCVE-2026-18638fixed in 0.77.2High 7.3Aug 11Rapid7 Velociraptor: authentication bypass by spoofingCVE-2026-18639fixed in 0.77.2