PT-2026-108730
CVE-2026-107911
·
Published
2026-10-09
·
Updated
2026-10-09
Description by
CVSS 4.0
7.7
HighMetricsAV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
FalkorDB versions prior to 4.20.0
Description
A type confusion issue exists in the
read flags() function (src/commands/cmd dispatcher.c). A remote authenticated attacker with permissions to execute GRAPH.QUERY can trigger this by providing a --bolt argument. The system casts a Redis string object to a Bolt client structure without verifying its origin, leading to the dereferencing of pointers read from that object. This can result in a denial of service, memory corruption, or memory disclosure. This issue persists even if the Bolt endpoint is disabled, affecting default configurations.Recommendations
Update to version 4.20.0 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾