SIGSEGV during graph query on v3.12.9.1-1
Author: CrocmagnonCreated Jun 23, 2026Updated Jun 23, 2026
Labels1 Bug3 AQL3 Graph
Running the following query crashes the server with a segfault:
127.0.0.1:8529@cmdb> db._explain('FOR d IN @@collectionName FILTER d.id == @id AND d.model == @model AND d.status == @status FOR vertex IN 0..@maxDepth OUTBOUND d GRAPH @graphName PRUNE pruneRes = vertex.status != @status OPTIONS { order: "bfs", uniqueVertices: "global" } FILTER !pruneRes RETURN DISTINCT vertex', {"maxDepth": 10, "id": "EU.7277", "model": "Rack", "status": "operational", "graphName": "cmdb", "@collectionName": "ConfigurationItem"})
Query String (278 chars, results cachable: true):
FOR d IN @@collectionName FILTER d.id == @id AND d.model == @model AND d.status == @status FOR
vertex IN 0..@maxDepth OUTBOUND d GRAPH @graphName PRUNE pruneRes = vertex.status != @status OPTIONS
{ order: "bfs", uniqueVertices: "global" } FILTER !pruneRes RETURN DISTINCT vertex
Execution plan:
Id NodeType Par Est. Comment
1 SingletonNode 1 * ROOT
12 IndexNode ✓ 1 - FOR d IN ConfigurationItem /* persistent index scan, index scan + document lookup (filter projections: `status`) (projections: `_id`) */ LET #8 = d.`_id` FILTER (d.`status` == "operational") /* early pruning */
5 TraversalNode ✓ 1 - FOR vertex /* vertex */ IN 0..10 /* min..maxPathDepth */ OUTBOUND #8 /* startnode */ GRAPH 'cmdb' /* order: bfs */
7 CalculationNode ✓ 1 - LET #5 = ! (vertex.`status` != "operational") /* simple expression */
8 FilterNode ✓ 1 - FILTER #5
10 CollectNode ✓ 1 - COLLECT #7 = vertex /* distinct */
11 ReturnNode 1 - RETURN #7
Indexes used:
By Name Type Collection Unique Sparse Cache Selectivity Fields Stored values Ranges
12 idx_ci_model_id persistent ConfigurationItem true false false 100.00 % [ `model`, `id` ] [ ] ((d.`model` == "Rack") && (d.`id` == "EU.7277"))
5 edge edge CIxCI false false false 72.81 % [ `_from` ] [ ] base OUTBOUND
Traversals on graphs:
Id Depth Vertex collections Edge collections Options Filter / Prune Conditions
5 0..10 ConfigurationItem CIxCI neighbors: true, uniqueVertices: global, uniqueEdges: path, order: bfs FILTER ! (vertex.`status` != "operational")
PRUNE (vertex.`status` != "operational")
Optimization rules applied:
Id Rule Name Id Rule Name Id Rule Name
1 move-calculations-up 4 remove-filter-covered-by-index 7 reduce-extraction-to-projection
2 remove-unnecessary-calculations 5 optimize-traversals 8 optimize-projections
3 use-indexes 6 move-filters-into-enumerate 9 async-prefetch
60 rule(s) executed, 1 plan(s) created, peak mem [b]: 0, exec time [s]: 0.00080dmesg:
grsec: From 5.39.111.3: Segmentation fault occurred at 0000000000000000 in /usr/sbin/arangod[SchedWorker:279110] uid/euid:993/993 gid/egid:996/996, parent /usr/lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/00x0000000007fe6a3e in GetDataBlockFromCache<rocksdb::Block_kIndex> () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:1406
1406 /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc: No such file or directory.
(gdb) bt full
#0 0x0000000007fe6a3e in GetDataBlockFromCache<rocksdb::Block_kIndex> () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:1406
No locals.
#1 MaybeReadBlockAndLoadToCache<rocksdb::Block_kIndex> () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:1650
No locals.
#2 0x0000000007fe6387 in RetrieveBlock<rocksdb::Block_kIndex> () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:1893
No locals.
#3 0x0000000008006fb6 in ReadIndexBlock () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/index_reader_common.cc:28
No locals.
#4 0x0000000008007174 in GetOrReadIndexBlock () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/index_reader_common.cc:47
No locals.
#5 0x000000000800324f in NewIterator () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/hash_index_reader.cc:118
No locals.
#6 0x0000000007fd911b in NewIndexIterator () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:1534
No locals.
#7 NewIterator () at /work/ArangoDB/3rdParty/rocksdb/table/block_based/block_based_table_reader.cc:2068
No locals.
#8 0x0000000007e4a9e9 in NewIterator () at /work/ArangoDB/3rdParty/rocksdb/db/table_cache.cc:262
No locals.
#9 0x0000000007e6d6f2 in AddIteratorsForLevel () at /work/ArangoDB/3rdParty/rocksdb/db/version_set.cc:2033
No locals.
#10 0x0000000007d1cb68 in AddIterators () at /work/ArangoDB/3rdParty/rocksdb/db/version_set.cc:2007
No locals.
#11 NewInternalIterator () at /work/ArangoDB/3rdParty/rocksdb/db/db_impl/db_impl.cc:2094
No locals.
#12 0x0000000007d2b17d in NewIteratorImpl () at /work/ArangoDB/3rdParty/rocksdb/db/db_impl/db_impl.cc:3921
No locals.
#13 NewIterator () at /work/ArangoDB/3rdParty/rocksdb/db/db_impl/db_impl.cc:3842
No locals.
#14 0x00000000077019ad in NewIterator () at /work/ArangoDB/arangod/RocksDBEngine/Methods/RocksDBReadOnlyMethods.cpp:71
No locals.
#15 0x00000000076145ac in lookupInRocksDB () at /work/ArangoDB/arangod/RocksDBEngine/RocksDBEdgeIndex.cpp:566
No locals.
#16 0x00000000076180b7 in nextImplementation<(lambda at /work/ArangoDB/arangod/RocksDBEngine/RocksDBEdgeIndex.cpp:291:9)> () at /work/ArangoDB/arangod/RocksDBEngine/RocksDBEdgeIndex.cpp:526
No locals.
#17 nextCoveringImpl () at /work/ArangoDB/arangod/RocksDBEngine/RocksDBEdgeIndex.cpp:290
No locals.
#18 0x000000000703f802 in nextCovering () at /work/ArangoDB/arangod/Indexes/IndexIterator.h:280
No locals.
#19 readNext () at /work/ArangoDB/arangod/Graph/Cursors/SingleServerEdgeCursor.cpp:333
No locals.
#20 0x00000000070e601f in next () at /work/ArangoDB/arangod/Graph/Cursors/SingleServerNeighbourCursor.cpp:71
No locals.
#21 0x000000000704d481 in pop () at /work/ArangoDB/arangod/Graph/Queues/CursorFifoQueue.h:163
No locals.
#22 0x000000000704d658 in pop () at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_deque.h:267
No locals.
[...]
#12444 0x000000000704d658 in pop () at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_deque.h:267
No locals.
#12445 0x0000000007058ea9 in computeNeighbourhoodOfNextVertex () at /work/ArangoDB/arangod/Graph/Enumerators/OneSidedEnumerator.cpp:119
No locals.
#12446 0x000000000705895d in searchMoreResults () at /work/ArangoDB/arangod/Graph/Enumerators/OneSidedEnumerator.cpp:295
No locals.
#12447 getNextPath () at /work/ArangoDB/arangod/Graph/Enumerators/OneSidedEnumerator.cpp:273
No locals.
#12448 0x0000000006df7d39 in doOutput () at /work/ArangoDB/arangod/Aql/Executor/TraversalExecutor.cpp:386
No locals.
#12449 produceRows () at /work/ArangoDB/arangod/Aql/Executor/TraversalExecutor.cpp:441
No locals.
#12450 0x00000000066b3380 in executeProduceRows () at /work/ArangoDB/arangod/Aql/ExecutionBlockImpl.tpp:1132
No locals.
#12451 executeWithoutTrace () at /work/ArangoDB/arangod/Aql/ExecutionBlockImpl.tpp:1956
No locals.
#12452 0x00000000066aea80 in execute () at /work/ArangoDB/arangod/Aql/ExecutionBlockImpl.tpp:547
No locals.
#12453 0x000000000646328b in executeForDependency () at /work/ArangoDB/arangod/Aql/DependencyProxy.cpp:81
No locals.
#12454 execute () at /work/ArangoDB/arangod/Aql/DependencyProxy.cpp:45
No locals.
#12455 0x00000000064fcf40 in execute () at /work/ArangoDB/arangod/Aql/SingleRowFetcher.cpp:51
No locals.
#12456 0x00000000066e80ce in execute () at /work/ArangoDB/arangod/Aql/ExecutionBlockImpl.tpp:2685
No locals.
#12457 operator() () at /work/ArangoDB/arangod/Aql/ExecutionBlockImpl.tpp:1068
No locals.
#12458 invoke () at /work/ArangoDB/arangod/Scheduler/Scheduler.h:207
No locals.
#12459 0x0000000007801dcf in runWorker () at /work/ArangoDB/arangod/Scheduler/SupervisedScheduler.cpp:481
No locals.
#12460 run () at /work/ArangoDB/arangod/Scheduler/SupervisedScheduler.cpp:153
No locals.
#12461 0x000000000858d9e6 in runMe () at /work/ArangoDB/lib/Basics/Thread.cpp:344
No locals.
#12462 startThread () at /work/ArangoDB/lib/Basics/Thread.cpp:147
No locals.
#12463 0x00000000085a208f in ThreadStarter () at /work/ArangoDB/lib/Basics/threads-posix.cpp:78
No locals.
#12464 0x0000000005a4396c in start_thread ()
No symbol table info available.
#12465 0x0000000005aa589c in clone3 ()
No symbol table info available.It happens on both single instance and cluster deployments, on a db dumped with arangodump and restored with arangorestore.
It does not happen for any dataset, only for large-enough ones. I wasn't able to find a minimal example for that yet.
Running the same query without the OPTIONS works fine.
127.0.0.1:8529@cmdb> db._explain('FOR d IN @@collectionName FILTER d.id == @id AND d.model == @model AND d.status == @status FOR vertex IN 0..@maxDepth OUTBOUND d GRAPH @graphName PRUNE pruneRes = vertex.status != @status FILTER !pruneRes RETURN DISTINCT vertex', {"maxDepth": 10, "id": "EU.7277", "model": "Rack", "status": "operational", "graphName": "cmdb", "@collectionName": "ConfigurationItem"})
Query String (227 chars, results cachable: true):
FOR d IN @@collectionName FILTER d.id == @id AND d.model == @model AND d.status == @status FOR
vertex IN 0..@maxDepth OUTBOUND d GRAPH @graphName PRUNE pruneRes = vertex.status != @status FILTER
!pruneRes RETURN DISTINCT vertex
Execution plan:
Id NodeType Par Est. Comment
1 SingletonNode 1 * ROOT
12 IndexNode ✓ 1 - FOR d IN ConfigurationItem /* persistent index scan, index scan + document lookup (filter projections: `status`) (projections: `_id`) */ LET #8 = d.`_id` FILTER (d.`status` == "operational") /* early pruning */
5 TraversalNode ✓ 1 - FOR vertex /* vertex */ IN 0..10 /* min..maxPathDepth */ OUTBOUND #8 /* startnode */ GRAPH 'cmdb' /* order: dfs */
7 CalculationNode ✓ 1 - LET #5 = ! (vertex.`status` != "operational") /* simple expression */
8 FilterNode ✓ 1 - FILTER #5
10 CollectNode ✓ 1 - COLLECT #7 = vertex /* distinct */
11 ReturnNode 1 - RETURN #7
Indexes used:
By Name Type Collection Unique Sparse Cache Selectivity Fields Stored values Ranges
12 idx_ci_model_id persistent ConfigurationItem true false false 100.00 % [ `model`, `id` ] [ ] ((d.`model` == "Rack") && (d.`id` == "EU.7277"))
5 edge edge CIxCI false false false 72.81 % [ `_from` ] [ ] base OUTBOUND
Traversals on graphs:
Id Depth Vertex collections Edge collections Options Filter / Prune Conditions
5 0..10 ConfigurationItem CIxCI uniqueVertices: none, uniqueEdges: path, order: dfs FILTER ! (vertex.`status` != "operational")
PRUNE (vertex.`status` != "operational")
Optimization rules applied:
Id Rule Name Id Rule Name Id Rule Name
1 move-calculations-up 4 remove-filter-covered-by-index 7 reduce-extraction-to-projection
2 remove-unnecessary-calculations 5 optimize-traversals 8 optimize-projections
3 use-indexes 6 move-filters-into-enumerate 9 async-prefetch
60 rule(s) executed, 1 plan(s) created, peak mem [b]: 0, exec time [s]: 0.00079We added this option as an optimization strategy on large graph traversals to avoid walking the same nodes multiple times.
Affected version 3.12$ arangosh --version
3.12.9-1
This executable uses the GNU C library (glibc), which is licensed under the GNU Lesser General Public License (LGPL), see https://www.gnu.org/copyleft/lesser.html and https://www.gnu.org/licenses/gpl.html
architecture: 64bit
arm: false
asan: false
assertions: false
avx: true
avx2: false
boost-version: 1.78.0
build-date: 2026-04-14 15:11:32
build-id: 61d43331e6af5f9bf18b723df3a3d0095dc3626e
build-repository: refs/tags/v3.12.9.1 418431221ce
compiler: clang [Ubuntu Clang 19.1.7 (++20250804090312+cd708029e0b2-1~exp1~20250804210325.79)]
coverage: false
cplusplus: 202002
curl-version: none
debug: false
endianness: little
enterprise-build-repository: refs/tags/v3.12.9.1 9cafb0e7
enterprise-version: enterprise
failure-tests: false
faiss: 1.9.0
fd-client-event-handler: poll
fd-setsize: 1024
full-version-string: ArangoDB 3.12.9-1 enterprise [linux] 64bit, using jemalloc, build refs/tags/v3.12.9.1 418431221ce, VPack 0.2.1, RocksDB 9.6.0, ICU 64.2, V8 12.1.165, OpenSSL 3.5.6 7 Apr 2026
icu-version: 64.2
ipo: true
iresearch-version: 1.3.0.0
jemalloc: true
libunwind: true
license: enterprise
maintainer-mode: false
memory-profiler: true
ndebug: true
openmp: 5.1
openssl-version-compile-time: OpenSSL 3.5.6 7 Apr 2026
openssl-version-run-time: OpenSSL 3.5.6 7 Apr 2026
optimization-flags: -mfxsr -mmmx -msse -msse2 -mcx16 -msahf -mpopcnt -msse3 -msse4.1 -msse4.2 -mssse3 -mpclmul -mavx -mxsave
pic: 2
pie: 2
platform: linux
reactor-type: epoll
replication2-enabled: false
rocksdb-version: 9.6.0
server-version: 3.12.9-1
sizeof int: 4
sizeof long: 8
sizeof void*: 8
sse42: true
tsan: false
unaligned-access: false
v8-version: 12.1.165
vpack-version: 0.2.1
zlib-version: 1.2.13Package installed via the debian repositories:
$ sudo dpkg -l arangodb3e
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-============-============-====================================================================
ii arangodb3e 3.12.9.1-1 amd64 a scalable graph database system to drive value from connected data,The affected query works fine on v3.11.5.
Detailed version 3.11$ arangosh --version
3.11.5
architecture: 64bit
arm: false
asan: false
assertions: false
avx: true
avx2: false
boost-version: 1.78.0
build-date: 2023-11-09 19:23:03
build-repository: refs/tags/v3.11.5 9cffc1f6fbd
compiler: gcc [11.2.1 20220219]
coverage: false
cplusplus: 202002
curl-version: none
debug: false
endianness: little
failure-tests: false
fd-client-event-handler: poll
fd-setsize: 1024
full-version-string: ArangoDB 3.11.5 [linux] 64bit, using jemalloc, build refs/tags/v3.11.5 9cffc1f6fbd, VPack 0.2.1, RocksDB 7.2.0, ICU 64.2, V8 7.9.317, OpenSSL 3.0.11 19 Sep 2023
icu-version: 64.2
ipo: true
iresearch-version: 1.3.0.0
jemalloc: true
libunwind: true
license: community
maintainer-mode: false
memory-profiler: true
ndebug: true
openssl-version-compile-time: OpenSSL 3.0.11 19 Sep 2023
openssl-version-run-time: OpenSSL 3.0.11 19 Sep 2023
optimization-flags: -mfxsr -mmmx -msse -msse2 -mcx16 -msahf -mpopcnt -msse3 -msse4.1 -msse4.2 -mssse3 -mpclmul -mavx -mxsave
pic: 2
pie: 2
platform: linux
reactor-type: epoll
replication2-enabled: false
rocksdb-version: 7.2.0
server-version: 3.11.5
sizeof int: 4
sizeof long: 8
sizeof void*: 8
sse42: true
tsan: false
unaligned-access: true
v8-version: 7.9.317
vpack-version: 0.2.1
zlib-version: 1.2.13Source: arangodb/arangodb