FalkorDB CVE-2026-107909

Exploitation requires that the target FalkorDB deployment has explicitly enabled the Bolt protocol endpoint via BOLT_PORT, which is disabled by default - so default installations are not exposed. When enabled and network-reachable, no authentication or user interaction is needed (PR:N/UI:N): the attacker simply sends a WebSocket frame using the 64-bit extended payload length field with an unbounded length value to the Bolt port. A secondary enabling factor is that the product is built as a release binary, where the ASSERT() bounds check in buffer_apply_mask is compiled out; a debug build would abort at the assertion instead. The practical limiting factor is the non-default Bolt configuration plus network exposure of that port.

Signals are moderately strong but qualified. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated trigger, and the impact profile (VI:H/VA:H, VC:N) matches the described heap out-of-bounds write causing denial of service and possible memory corruption without confidentiality loss - consistent with CWE-787. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'; the vulnerability is not known to be actively exploited. The single most important mitigating factor is that only deployments that explicitly enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected, which sharply reduces the real-world attack surface despite the network vector. This is therefore a genuine priority for the subset of operators who have turned on Bolt and exposed the port, but a low-urgency issue for the default-configured majority. The write primitive is an attacker-controlled XOR of the mask key beyond the receive buffer, which realistically yields reliable crashes (DoS); escalation to code execution is described as only 'possibly' achievable and is not demonstrated. Net: patch-worthy and clearly real, but gated by a non-default configuration rather than a universally exposed flaw.

An attacker who can reach a FalkorDB instance that has the Bolt endpoint enabled sends a crafted WebSocket frame declaring a 64-bit extended payload length far larger than the receive buffer. Because the only bounds check in buffer_apply_mask is an ASSERT() compiled out of release builds, the server XORs memory past the end of the heap buffer with the attacker-supplied mask key, corrupting heap memory and crashing the process. No public exploit code was identified, and no authentication is required per the PR:N vector.