Out-of-bounds write in FalkorDB Bolt WebSocket frame handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
FalkorDB before 4.20.0 has a heap out-of-bounds write (CWE-787) in its Bolt WebSocket frame handling. The payload length is not bounded, and the only bounds check is compiled out of release builds, so the masking step writes past the receive buffer. A remote unauthenticated attacker can send a crafted WebSocket frame to the Bolt port to cause denial of service and possibly heap corruption. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade FalkorDB to version 4.20.0 or later, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA FalkorDB (FalkorDB) Fixed in 4.20.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
FalkorDB 4.20.0
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-69850 Heap out-of-bounds write in FalkorDB Bolt RESET handlerPriority MEDIUM 49
- TI-2026-69852 Authentication bypass in FalkorDB Bolt endpointPriority MEDIUM 42
- TI-2026-69853 Type confusion in FalkorDB GRAPH.QUERY via the --bolt argumentPriority LOW 36
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107909
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Patch 2
More FalkorDB vulnerabilities
- TI-2026-05312 Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2026-69850 Heap out-of-bounds write in FalkorDB Bolt RESET handler CVSS 4.0CRITICAL 9.3
- TI-2026-69847 Double free and use-after-free in FalkorDB RDB loading CVSS 4.0CRITICAL 9.3
- TI-2026-08883 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts CVSS 4.0HIGH 8.8
- TI-2026-69848 Heap out-of-bounds read in FalkorDB via crafted RDB stream CVSS 4.0HIGH 8.8
- TI-2026-69852 Authentication bypass in FalkorDB Bolt endpoint CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences