What this actually is.
Technical background, root cause, and affected surface.
A heap-based out-of-bounds write in BoltReadHandler (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to corrupt heap memory by sending a Bolt RESET message with an attacker-chosen chunk size. The only guard, ASSERT(size == 2), compiles to nothing in release builds, so the handler computes dst = src - size - 4 from the wire-controlled uint16 size and memmoves data up to ~65 KiB backwards past the start of the read buffer. Bolt is disabled by default (BOLT_PORT=-1); only deployments that set BOLT_PORT are exposed.
- Vendor
- FalkorDB
- Product
- FalkorDB
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Fixed (v4.20.0)
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-787
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
# Without sanitizers, expect: connection RST or redis-server crash with SIGSEGV.
The bug, and the fix.
// src/bolt/bolt_api.c (verified at v4.18.10 lines 777-785, and identical in master 835d06e): if(request_type == BST_RESET) { ASSERT(size == 2); // <-- no-op in release (src/RG.h:74) ... char *src = client->read_buf.chunks[current_read.chunk] + current_read.offset; char *dst = src - size - 4; // attacker drives size up to 65535 size = buffer_index_length(¤t_read); memmove(dst, src, size); // backward OOB write }
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Heap memory corruption (backward out-of-bounds write of up to ~65 KiB of attacker-controlled data) reachable before authentication by any TCP client of the Bolt port; at minimum a crash of the redis-server process, potentially code execution depending on heap layout. Only deployments with BOLT_PORT configured are exposed. Assessed from source review; runtime exploitation and code execution were not demonstrated end to end.
C:H · I:H · A:H
CWE-787
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade FalkorDB to 4.20.0 or later, where the Bolt subsystem has been removed (PR #2170), or move to 6.x. Interim for older versions: leave BOLT_PORT unset (default) or restrict the Bolt port to trusted networks.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Source-level audit of FalkorDB v4.18.10; re-verified against upstream master 835d06e on 2026-06-24 (2026-04 to 2026-06-29)
Reported to FalkorDB security team (security@falkordb.com) as part of a 6-finding disclosure pack; vendor acknowledged receipt the same day
Vendor removed the Bolt subsystem (PR #2170, commit 0b11a00) - no advisory or credit
FalkorDB 4.20.0 released without Bolt support
90-day coordinated disclosure window ended with no further vendor response
FalkorDB 6.0.0 released (Rust engine; C code base not present)
Securin re-verified: Bolt code absent from 4.20.0, 4.20.7, 4.22.0 and 6.0.2 | CVE-2026-107908 assigned by Securin CNA
CVE-2026-107908 published to the CVE List by Securin CNA (NVD import pending)
Disclosed 9 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.