ArcadeDB 26.6.1 security patch: fixes SSRF, SQLi, LPE and JSON injection

ArcadeDB 26.6.1 Security and Stability Update Summary Vulnerability Overview This 26.6.1 release primarily focuses on security hardening and crash recovery, with core fixes for multiple security vulnerabilities: Privilege Escalation: schema modifications now require privilege (previously, only was controlled). SSRF: now validates the privileges for sources and query parameters, closing the Server-Side Request Forgery (local file read) vulnerability. SQL Injection: Fixed a SQL injection issue in . JSON Parsing: Fixed JSON injection caused by the "pseudo-JSON" source-concatenation heuristic in the polyglot engine. Code Scanning: Addressed Java and JavaScript code scanning alerts (workflow permissions, RedoS, path injection). Scope of Impact HA Clusters: Ratf-based HA clusters now support full encryption, fixing crashes in the snapshot installer when listening on an HTTPS listener. Data Persistence: WAL is synchronized by default at commit time, and data files are synchronized before WAL files are deleted, ensuring no data loss after a crash. Concurrency and Asynchrony: Fixed multi-thread synchronization issues in (CME/AIOBE), and concurrent modification issues in . OpenCypher: Fixed the behavior of for variable-length patterns, as well as multiple logic errors in and . Vectors and Indexes: Fixed state inconsistency when the dimension of an index is 0, and identification issues with . Wire Protocols: Fixed issues with queries in the Bolt protocol, scalar columns in gRPC, and and in the PostgreSQL protocol. Fixes Implemented TLS/SSL: Ratf-based HA clusters support SSL/TLS; the snapshot installer fixed crashes caused by unsupported or unrecognized SSL messages. Crash Recovery: WAL is synchronized at commit, and data files are synchronized before WAL file deletion, ensuring data persists after a crash. Security Hardening: schema modifications require privilege. validates privileges for sources and query parameters, closing the SSRF vulnerability. Fixed SQL injection in . Fixed JSON injection in the polyglot engine. Addressed Java and JavaScript code scanning alerts. High Availability and Clusters: Fixed TimeSeries data replication issues in HA clusters, as well as WAL version gaps caused by snapshot/append deduplication. Concurrency and Asynchrony: Fixed multi-thread synchronization issues in , and concurrent modification issues in . OpenCypher: Fixed the behavior of for variable-length patterns, and multiple logic errors in and . SQL: Fixed multiple issues related to parameters, projections, selectors, and functions, timestamps, functions, , , conversions, , , , and . Vectors and Indexes: Fixed state inconsistency with when the dimension of an index is 0, and multiple issues with . Wire Protocols: Fixed issues with queries in the Bolt protocol, scalar columns in gRPC, and and in the PostgreSQL protocol. Studio and Operations: Added production-mode Studio, new slide templates, AI-assisted workflows, and new offline build modules. Dependencies**: Updated multiple dependency libraries, including Netty, UnderTow, Protobuf, JLine, JHunt Jupiter, Jackson Databind, Apache Commons Configuration, Swagger, SLF4J, Logback, Jedis, etc.

Goal Reached Thanks to every supporter — we hit 100%!

ArcadeDB 26.6.1 security patch: fixes SSRF, SQLi, LPE and JSON injection

More from this source