FalkorDB CVE-2026-107908

The target must have the Bolt protocol endpoint explicitly enabled via BOLT_PORT, which is disabled by default - this is the single decisive precondition and sharply limits the exposed population. When enabled and network-reachable, no authentication or user interaction is required (PR:N/UI:N): the attacker simply sends a Bolt RESET message specifying an attacker-chosen 16-bit chunk size. The flaw is exploitable only against release builds where the ASSERT() size check is compiled out (the normal production configuration). Reliable denial of service is the confirmed impact; arbitrary code execution is described as a possibility and is not demonstrated, so defenders with Bolt disabled or firewalled off face no exposure from this issue.

This is a genuinely high-severity flaw but with an important deployment caveat that tempers real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 9.3 - fully consistent with the description of a remote unauthenticated heap out-of-bounds write (CWE-787). The CWE, the diff reference, and the description all agree: an ASSERT()-only size check (compiled out in release builds) lets a wire-supplied 16-bit size drive a ~64 KiB backward copy past the read buffer. However, several signals pull the practical priority down: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization. Most importantly, exploitation requires the Bolt endpoint (BOLT_PORT) to be explicitly enabled - it is disabled by default - so the network-attack surface exists only in a subset of deployments. The 'possibly execute arbitrary code' qualifier is honest hedging: reliable DoS is near-certain, but RCE from a backward heap copy is not demonstrated and should be treated as plausible-but-unproven. Net assessment: patch promptly if Bolt is enabled and internet-exposed; lower urgency where Bolt is disabled. EPSS/KEV/POC data is absent rather than confirmed-negative, so monitor for emerging exploit code.

A FalkorDB instance has the optional Bolt endpoint enabled and reachable over the network. A remote unauthenticated attacker connects to the Bolt port and sends a RESET message carrying a crafted 16-bit chunk size; the handler trusts this size (the bounds check is only an ASSERT compiled out of release builds) and copies up to ~64 KiB of buffered data backward past the start of the heap read buffer, crashing the service and potentially corrupting adjacent heap structures. No public exploit code was identified at time of analysis, so this reflects the described mechanism rather than an observed campaign.