PT-2026-108730
CVE-2026-107911
·
تاريخ النشر
2026-10-09
·
تاريخ التحديث
2026-10-09
الوصف من
CVSS 4.0
7.7
عاليةالمقاييسAV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
FalkorDB versions prior to 4.20.0
Description
A type confusion issue exists in the
read flags() function (src/commands/cmd dispatcher.c). A remote authenticated attacker with permissions to execute GRAPH.QUERY can trigger this by providing a --bolt argument. The system casts a Redis string object to a Bolt client structure without verifying its origin, leading to the dereferencing of pointers read from that object. This can result in a denial of service, memory corruption, or memory disclosure. This issue persists even if the Bolt endpoint is disabled, affecting default configurations.Recommendations
Update to version 4.20.0 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾