Heap-Based Out-of-Bounds Write in FalkorDB Revealed
CVE-2026-107909

8.8HIGH

Key Information:

Vendor

Falkordb

Status
Falkordb
Vendor
CVE Published:
9 October 2026

What is CVE-2026-107909?

A vulnerability in FalkorDB allows an unauthenticated remote attacker to exploit a heap-based out-of-bounds write through the ws_read_frame function and the buffer_apply_mask function. This occurs when the attacker sends a WebSocket frame with a 64-bit extended payload length to the Bolt port, which, when enabled, lacks proper bounds checks, leading to potential denial of service and memory corruption. Affected installations are those with the Bolt endpoint activated, which is typically disabled by default. Updates have been made in version 4.20.0 to address this issue.

Affected Version(s)

FalkorDB 0 < 4.20.0

References

https://github.com/FalkorDB/FalkorDB/pull/2170
patch
https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25...
patch
https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0
release-notes

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arjun Basnet from Securin
.