{"id":"CVE-2026-64951","aliases":["EUVD-2026-57160","GHSA-frg5-mq2m-h39j","openSUSE-SU-2026:12070-1"],"status":"published","title":"Velociraptor DoS triggered by Divide by Zero panic","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00281,"percentile":0.20779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-369"],"published":"2026-08-12T09:49:25Z","modified":"2026-10-28T02:30:27Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"rapid7","product":"velociraptor"}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64951","tags":["advisory"]},{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-64951"},{"url":"https://github.com/advisories/GHSA-frg5-mq2m-h39j"},{"url":"https://github.com/Velocidex/velociraptor/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64951.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64951","title":"Velociraptor DoS triggered by Divide by Zero panic","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","status":"published","published":"2026-08-12T09:49:25.635Z","modified":"2026-08-12T12:29:02.448Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-57160","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","status":"published","published":"2026-08-12T09:49:25Z","modified":"2026-08-12T12:29:02Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T18:01:59.11112Z"}],"ghsa":[{"id":"GHSA-frg5-mq2m-h39j","title":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to...","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","status":"published","published":"2026-08-12T12:32:53Z","modified":"2026-08-12T12:33:05Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:10:22.198935Z"}],"nvd":[{"id":"CVE-2026-64951","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","status":"published","published":"2026-08-12T10:17:20.063Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:12:36.880938Z"}],"osv":[{"id":"CVE-2026-64951","title":"Velociraptor DoS triggered by Divide by Zero panic","description":"A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the ShouldPadFile() function.","status":"published","published":"2026-08-12T09:49:25.635Z","modified":"2026-10-28T02:30:27.242180195Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}