FalkorDB Critical Heap Overflow Allows Remote Code Execution via Bolt Protocol

A critical security vulnerability has been identified in FalkorDB, a graph database system, affecting all versions prior to 4.20.0. The flaw, tracked as CVE-2026-107908, allows remote, unauthenticated attackers to execute arbitrary code or trigger a denial of service condition by sending a specially crafted message to the database’s Bolt port.

The vulnerability stems from a heap-based out-of-bounds write error within the `BoltReadHandler` function, located in the `src/bolt/bolt_api.c` source file. According to the National Vulnerability Database (NVD), the issue arises when the handler processes a Bolt RESET message containing an attacker-chosen chunk size. The code attempts to validate this size using an `ASSERT()` macro.

However, in release builds, these assertions are compiled out, leaving the input unchecked. The handler then computes a destination pointer based on the 16-bit size supplied over the wire and moves buffered data—up to approximately 64 KiB—backwards past the start of the read buffer. This out-of-bounds write can lead to memory corruption, enabling remote code execution or crashing the service.

Technical Context and Mitigation Status

The NVD record classifies the underlying weakness as CWE-787, which relates to out-of-bounds write errors. The severity is rated as Critical with a CVSS score of 9.3, indicating a high potential for impact on confidentiality, integrity, and availability. The exploitability vector is network-based, requiring no authentication, which significantly increases the risk profile for exposed systems.

As of the publication of this report, no patch or security update has been confirmed by the vendor for versions prior to 4.20.0. Users running affected versions are advised to monitor official FalkorDB channels for the release of version 4.20.0 or a subsequent security bulletin. Until a fix is available, the primary mitigation is to ensure the Bolt endpoint is not exposed to untrusted networks.

Affected Systems and Exposure Scope

The impact of CVE-2026-107908 is strictly limited to deployments that have explicitly enabled the Bolt endpoint. The Bolt protocol port (`BOLT_PORT`) is disabled by default in FalkorDB configurations. Therefore, standard installations that rely on other communication methods do not expose this specific attack surface.

Administrators must verify whether their database instances are configured to listen on the Bolt port. If the endpoint is active and accessible from the internet or untrusted internal networks, the system is vulnerable to remote exploitation. The vulnerability does not affect the core graph storage engine directly but rather the network interface handler responsible for processing Bolt protocol messages.

What should you do?

Security teams should immediately audit their FalkorDB deployments to determine if the Bolt endpoint is enabled. If the service is running a version older than 4.20.0 and the Bolt port is active, it should be disabled or restricted via firewall rules to trusted management IPs only. Once the vendor provides an update, administrators should apply version 4.20.0 or later to resolve the heap overflow issue.