CVE-2026-107911: Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument
A type confusion vulnerability in the readflags function (src/commands/cmddispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FalkorDBto a version that resolves this vulnerability.Fixed in 4.20.0
Event History
Frequently Asked Questions
Who can exploit this issue in a typical deployment?
A remote attacker must be authenticated and have permission to run GRAPH.QUERY. Because --bolt is parsed even when the Bolt endpoint is disabled, deployments using the default configuration are affected if such a user can issue GRAPH.QUERY commands.
Does disabling the Bolt endpoint mitigate the vulnerability?
No. The vulnerable --bolt argument parsing occurs even when the Bolt endpoint is disabled.
What can happen if exploitation succeeds?
An attacker may cause a denial of service and could possibly disclose or corrupt memory. The vulnerable code treats a client-supplied Redis string argument as a Bolt client structure and later dereferences pointers from it.
Which versions need remediation?
FalkorDB versions before 4.20.0 are affected. Updating to version 4.20.0 or later addresses the affected version range.