Description
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Published: 2026-10-09
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote unauthenticated heap out‑of‑bounds write that can lead to denial of service or arbitrary code execution.
Action: Immediate Patch
AI Analysis

Impact

A heap‑based out‑of‑bounds write occurs in the BoltReadHandler of FalkorDB when processing a Bolt RESET message. The reset size is accepted only through an ASSERT guard that is removed from release builds, allowing an attacker to supply a 16‑bit size that causes data to be copied up to 64 KiB past the start of the read buffer. This flaw may corrupt memory, trigger a crash resulting in denial of service, and potentially enable arbitrary code execution.

Affected Systems

FalkorDB versions prior to 4.20.0 that expose the Bolt endpoint (the BOLT_PORT module) are affected. By default the Bolt endpoint is disabled, but if it has been enabled through the configuration, the vulnerability applies.

Risk and Exploitability

The flaw is exploitable remotely by any unauthenticated client that can reach the Bolt port. EPSS information is not available, but the CVSS score of 9.3 indicates high severity. The vulnerability is not listed in CISA KEV and no mitigation is provided by default; the attacker needs only to send a crafted RESET message to trigger the OOB write.

Generated by OpenCVE AI on October 9, 2026 at 06:22 UTC.

Remediation

Vendor Solution

Upgrade FalkorDB to version 4.20.0 or later. Bolt protocol support, including the code affected by this issue, was removed in 4.20.0.

Vendor Workaround

Leave the Bolt endpoint disabled (do not set the BOLT_PORT module configuration; it is disabled by default), or restrict network access to the Bolt port to trusted clients.

OpenCVE Recommended Actions

  • Upgrade FalkorDB to version 4.20.0 or later, which removes the Bolt protocol and the affected code.
  • Leave the Bolt endpoint disabled – do not set the BOLT_PORT configuration – or, if Bolt must remain, restrict the port to trusted clients through firewall or network segmentation.
  • Verify that no older FalkorDB versions are running on any exploit‑able hosts and monitor for unexpected Bolt traffic to detect potential exploitation attempts.

Generated by OpenCVE AI on October 9, 2026 at 06:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.
Title Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message
First Time appeared Falkordb
Falkordb falkordb
Weaknesses CWE-787
CPEs cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*
Vendors & Products Falkordb
Falkordb falkordb
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Falkordb Falkordb
cve-icon MITRE

Status: PUBLISHED

Assigner: securin

Published:

Updated: 2026-10-15T15:48:53.580Z

Reserved: 2026-10-09T04:54:39.618Z

Link: CVE-2026-107908

cve-icon Vulnrichment

Updated: 2026-10-15T15:48:48.526Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T06:17:10.777

Modified: 2026-10-15T16:17:35.263

Link: CVE-2026-107908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T07:30:17Z

Weaknesses