FalkorDB: Heap out-of-bounds write in Bolt protocol handler
Summary
FalkorDB before 4.20.0 contains a heap-based out-of-bounds write in the Bolt protocol handler (BoltReadHandler). A remote, unauthenticated attacker can send a crafted Bolt RESET message with a chosen chunk size, which can cause a denial of service and possibly arbitrary code execution. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Affected
- FalkorDB versions before 4.20.0 with the Bolt endpoint enabled (BOLT_PORT set)
- Default configuration is not affected
Fixed in
- Upgrade to FalkorDB 4.20.0 or later
- Bolt protocol support, including the affected code, was removed in 4.20.0
Workaround
- Leave the Bolt endpoint disabled (do not set BOLT_PORT)
- If Bolt is required, restrict network access to the Bolt port to trusted clients only
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No confirmed in-the-wild exploitation known at the time of writing
- Not listed in CISA KEV
Our recommendation
- Check whether BOLT_PORT is set on any FalkorDB instance
- Upgrade to FalkorDB 4.20.0 or later as a priority where Bolt is enabled
- Where Bolt cannot be disabled immediately, block the Bolt port from untrusted networks
- Monitor for unexpected connections to the Bolt port
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-107908 on OSV osv.dev
- Fix commit 0b11a00 (remove bolt support) github.com
- Pull Request #2170 (remove bolt support) github.com
- FalkorDB release v4.20.0 github.com
- CVE Brief archive, 2026-10-09 cvebrief.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:51.
Original description (NVD)
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.