Dos via Memory Exhaustion in range() Function

Description of the security issue (*): The nebula-graphd service does not enforce sufficient upper bounds or memory checks when executing the range() function. When a user requests a range with an extremely large upper bound (e.g., INT64_MAX), the server attempts to allocate memory for the entire sequence immediately.

This behavior results in rapid consumption of all available server memory, triggering the operating system's OOM killer to terminate the nebula-graphd process. This allows an unprivileged attacker with execute permissions to crash the database service reliably.

Impacted Components (*):

Component: nebula-graphd (Query Engine)

Version: v3.8.0，Latest

Environment: Docker Container (Linux)

Reproduction Steps (*):

Connect to the NebulaGraph console.

Execute the following nGQL command attempting to create a range up to the maximum 64-bit integer:

RETURN range(1, 9223372036854775807); Observation: The client connection disconnects immediately ("connection refused").

Server Logs: The server logs indicate an OOM Kill event:

Out of memory: Killed process XXXXXX (nebula-graphd) total-vm:672743924kB...

Suggested Remediation:

Implement a hard limit on the number of elements the range() function can return in a single query.

Implement lazy evaluation (iterators) for range generation so that the entire list is not materialized in memory at once.

Enforce MAX_MEMORY limits per query execution more strictly to catch this before the OS kills the process.

Crash Evidence: (root@nebula) [(none)]> RETURN range(1, 9223372036854775807); 2025/12/07 06:48:06 Loop error, failed to reconnect, failed to open transport, error: dial tcp 127.0.0.1:9669: connect: connection refused

---

[Sun Dec 7 14:47:59 2025] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=docker-23400ac57a450f8c051cef8dc8f49c83e1fe1b18d11c2b4e4a85bf2fd95e5851.scope,mems_allowed=0,global_oom,task_memcg=/system.slice/docker-23400ac57a450f8c051cef8dc8f49c83e1fe1b18d11c2b4e4a85bf2fd95e5851.scope,task=nebula-graphd,pid=749557,uid=0 [Sun Dec 7 14:47:59 2025] Out of memory: Killed process 749557 (nebula-graphd) total-vm:672743924kB, anon-rss:236799776kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:466268kB oom_score_adj:0