CVE-2026-107911 Details
Description
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.
A type confusion vulnerability has been identified in FalkorDB versions prior to 4.20.0. The issue arises in the _read_flags function within the cmd_dispatcher.c file. This vulnerability allows remote authenticated attackers who can execute GRAPH.QUERY to cause a denial-of-service, and potentially disclose or corrupt memory. The vulnerability occurs because the function accepts a --bolt argument from any client and improperly casts a Redis string object command argument to a Bolt client structure without verifying its origin. This mismanagement allows the result-set code to dereference pointers from the object, leading to the described impacts. Notably, the argument is parsed even when the Bolt endpoint is disabled, affecting default configurations.
Users can upgrade to FalkorDB version 4.20.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d | securin | Source CodeVendor |
| https://github.com/FalkorDB/FalkorDB/pull/2170 | securin | Issue TrackingVendor |
| https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0 | securin | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | securin |
Affected Products
| Product | Versions |
|---|---|
| FalkorDB | < 4.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | securin |