CVE-2026-107909: falha de alta gravidade em FalkorDB
Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length
Publicada em
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
FalkorDB · FalkorDBCVEs relacionadas — FalkorDB
No mesmo produto, das mais perigosas para as menos.
CVE-2026-107911HIGHType confusion in FalkorDB GRAPH.QUERY via the --bolt argumentEPSS —CVE-2026-107910CRITICALAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingEPSS —CVE-2026-107908CRITICALPre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET messageEPSS —CVE-2026-7826HIGHHeap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDBEPSS —CVE-2026-7827CRITICALStack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDBEPSS —CVE-2026-5759CRITICALDouble free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDBEPSS —