Description
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Published: 2026-10-09
Score: 9.3 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade FalkorDB to version 4.20.0 or later. Bolt protocol support, including the code affected by this issue, was removed in 4.20.0.

Vendor Workaround

Leave the Bolt endpoint disabled (do not set the BOLT_PORT module configuration; it is disabled by default), or restrict network access to the Bolt port to trusted clients.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Title Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message
First Time appeared Falkordb
Falkordb falkordb
Weaknesses CWE-787
CPEs cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*
Vendors & Products Falkordb
Falkordb falkordb
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Falkordb Falkordb
cve-icon MITRE

Status: PUBLISHED

Assigner: securin

Published:

Updated: 2026-10-09T05:08:06.419Z

Reserved: 2026-10-09T04:54:39.618Z

Link: CVE-2026-107908

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses