CVE-2026-107909: high-severity vulnerability in FalkorDB
Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length
Published
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
exploitation probability
—
observed exploitation
nono source reports it
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FalkorDB · FalkorDBRelated CVEs — FalkorDB
In the same product, most dangerous first.
CVE-2026-107911HIGHType confusion in FalkorDB GRAPH.QUERY via the --bolt argumentEPSS —CVE-2026-107910CRITICALAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingEPSS —CVE-2026-107908CRITICALPre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET messageEPSS —CVE-2026-7826HIGHHeap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDBEPSS —CVE-2026-7827CRITICALStack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDBEPSS —CVE-2026-5759CRITICALDouble free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDBEPSS —