CVE-2026-107909

Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.20.0

Description A heap-based out-of-bounds write exists in the ws read frame() function (src/bolt/ws.c) and the buffer apply mask() function (src/bolt/buffer.c). A remote unauthenticated attacker can cause a denial of service or corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. Because the payload length is not bounded and the bounds check in buffer apply mask() is an ASSERT() that is removed in release builds, the function XORs memory beyond the receive buffer using an attacker-supplied mask key. This issue only affects deployments where the Bolt endpoint BOLT PORT is enabled.

Recommendations Update to version 4.20.0 or later. Disable the BOLT PORT endpoint to minimize the risk of exploitation.