The vulnerability is a heap-based out‑of‑bounds write that occurs in FalkorDB’s WebSocket handling code when a frame with a 64‑bit extended payload length is received. The code does not limit the length of the payload, and the only bounds check is an ASSERT that is stripped from release builds. As a result, an attacker can send a crafted WebSocket frame to the Bolt endpoint and cause the server to overwrite memory beyond the receive buffer, leading to a denial of service and potentially corrupting heap data. This weakness is classified as CWE‑787.

Affected systems are installations of FalkorDB before version 4.20.0 that have the Bolt endpoint enabled (the BOLT_PORT configuration). The Bolt protocol support, which contains the vulnerable code, was removed in 4.20.0, so any deployment running a previous version with the port enabled is vulnerable. By default, the Bolt endpoint is disabled, so only configurations that explicitly enable it are at risk.

The CVSS score of 8.8 indicates a high severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only network access to the Bolt port and no prior authentication, an unauthenticated remote adversary can exploit it. If the vulnerability is leveraged to corrupt heap memory, it could provide a foothold for further attacks depending on the system’s kernel or other vulnerabilities. Organizations should assess whether the Bolt endpoint is necessary and act accordingly.