CVE-2026-107909 Details
Description
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
A heap-based out-of-bounds write vulnerability has been identified in FalkorDB versions prior to 4.20.0. The issue arises in the 'ws_read_frame' function within 'src/bolt/ws.c' and the 'buffer_apply_mask' function in 'src/bolt/buffer.c'. This vulnerability allows remote, unauthenticated attackers to cause a denial-of-service condition and potentially corrupt heap memory. The exploitation involves sending a WebSocket frame with a 64-bit extended payload length to the Bolt port, which is enabled by default. The lack of proper bounds checking in the 'buffer_apply_mask' function, where the only safeguard is an ASSERT() removed in release builds, allows the function to XOR memory beyond the end of the receive buffer with an attacker-supplied mask key.
Users can upgrade to FalkorDB version 4.20.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d | securin | Source CodeVendor |
| https://github.com/FalkorDB/FalkorDB/pull/2170 | securin | Issue TrackingVendor |
| https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0 | securin | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | securin |
Affected Products
| Product | Versions |
|---|---|
| FalkorDB | < 4.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | securin |