FalkorDB: Heap out-of-bounds write in Bolt WebSocket frame handling
Summary
FalkorDB versions before 4.20.0 contain a heap-based out-of-bounds write in the Bolt endpoint's WebSocket frame handling. A remote, unauthenticated attacker can send a crafted frame with an oversized 64-bit payload length to the Bolt port, which can crash the service (denial of service) and possibly corrupt heap memory. The issue only applies if the Bolt endpoint (BOLT_PORT) is enabled, which is disabled by default.
Affected
- FalkorDB versions before 4.20.0 with the Bolt endpoint (BOLT_PORT) enabled
- Default configurations (Bolt disabled) are not affected
Fixed in
- FalkorDB 4.20.0 and later (Bolt protocol support was removed in 4.20.0)
Workaround
- Keep the Bolt endpoint disabled (do not set BOLT_PORT)
- If Bolt is required, restrict network access to the Bolt port to trusted clients
Exploitation
- Not known to be exploited in the wild (CISA SSVC: exploitation none)
- CISA SSVC: automatable yes, technical impact total
- No confirmed public proof of concept found
Our recommendation
- Check whether FalkorDB is deployed and whether BOLT_PORT is set
- Upgrade to FalkorDB 4.20.0 or later
- Until upgraded, disable the Bolt endpoint or block the Bolt port from untrusted networks
- Monitor for service crashes and for security advisories from the vendor
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-107909 OSV osv.dev
- FalkorDB release v4.20.0 github.com
- FalkorDB fix commit 0b11a00 github.com
- FalkorDB pull request #2170 github.com
- Tenable CVE-2026-107909 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:04.
Original description (NVD)
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.