CVE-2026-107908: FalkorDB Heap-Based RCE Vulnerability

CVE-2026-107908 Overview

CVE-2026-107908 is a heap-based out-of-bounds write [CWE-787] in the BoltReadHandler function located in src/bolt/bolt_api.c of FalkorDB before version 4.20.0. A remote unauthenticated attacker can trigger the flaw by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler validates the size only through ASSERT(), which release builds compile out, and then uses the untrusted 16-bit size to compute a destination pointer. This allows the handler to move up to approximately 64 KiB of buffered data backwards past the start of the read buffer. The condition enables denial of service and potentially arbitrary code execution.

Critical Impact

Unauthenticated remote attackers can corrupt heap memory in FalkorDB deployments that expose the Bolt endpoint, leading to crashes and possible code execution.

Affected Products

• FalkorDB versions prior to 4.20.0
• Deployments that explicitly enable the Bolt endpoint via BOLT_PORT (disabled by default)
• Any FalkorDB instance reachable on the configured Bolt port by untrusted clients

Discovery Timeline

• 2026-10-09 - CVE-2026-107908 published to the National Vulnerability Database
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-107908

Vulnerability Analysis

FalkorDB implements the Neo4j Bolt wire protocol inside src/bolt/bolt_api.c to accept graph database queries. The BoltReadHandler function processes incoming Bolt frames and reads a 16-bit chunk size from the wire before copying buffered data within an internal read buffer. When a client transmits a RESET message, the handler uses the supplied chunk size to compute an offset relative to the start of the buffer. Because the size is attacker-controlled and only validated by an assertion that is removed in release builds, the computed destination pointer can land before the buffer's base address. The handler then moves up to roughly 64 KiB of data backwards past the start of the read buffer, overwriting adjacent heap allocations.

Root Cause

The root cause is the use of ASSERT() as the sole bounds check on an untrusted 16-bit size supplied by a network peer. Assertion-based validation is a compile-time construct that production release builds strip out, leaving no runtime protection. The handler trusts the wire value when computing pointer arithmetic for the subsequent memory move, producing a classic out-of-bounds write [CWE-787].

Attack Vector

Exploitation requires network reachability to the Bolt port and no authentication. An attacker opens a TCP connection to the configured BOLT_PORT, negotiates the Bolt protocol handshake, and transmits a crafted RESET message whose chunk header specifies an attacker-chosen size. The resulting heap corruption can crash the FalkorDB process immediately or be shaped to achieve arbitrary code execution within the database process context. Only deployments that explicitly enable the Bolt endpoint are affected, since BOLT_PORT is disabled by default.

// Patch excerpt: upstream removes Bolt protocol support entirely
// Source: https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d

-// listen to bolt port
-// add the socket to the event loop
-int BoltApi_Register
-(
-    RedisModuleCtx *ctx  // redis context
-);
-
-// free connected clients
-void BoltApi_Unregister
-(
-    void
-);

Source: GitHub Commit 0b11a00b

Detection Methods for CVE-2026-107908

Indicators of Compromise

• Unexpected crashes or restarts of the FalkorDB process with signals such as SIGSEGV or SIGABRT originating from BoltReadHandler
• Inbound TCP connections to the configured BOLT_PORT from untrusted source addresses
• Abnormally large or malformed Bolt chunk headers observed in packet captures of Bolt traffic
• Core dumps containing heap corruption artifacts near Bolt read buffer allocations

Detection Strategies

• Inspect FalkorDB service logs for repeated handler faults, segmentation violations, or heap integrity errors tied to Bolt message processing
• Deploy network signatures that flag Bolt RESET messages advertising oversized chunk sizes to the FalkorDB Bolt port
• Correlate FalkorDB restart events with inbound Bolt connections from unauthorized source IP ranges

Monitoring Recommendations

• Enable process-level crash telemetry and forward it to a centralized logging platform for alerting on FalkorDB termination events
• Monitor exposure of BOLT_PORT through continuous external attack-surface scans
• Track protocol-level anomalies on Bolt sessions, including unexpected message types from unauthenticated peers

How to Mitigate CVE-2026-107908

Immediate Actions Required

• Upgrade FalkorDB to version 4.20.0 or later, which removes the vulnerable Bolt implementation entirely
• If upgrading is not immediately possible, disable the Bolt endpoint by ensuring BOLT_PORT is not configured
• Restrict network access to any exposed Bolt port using firewall rules so only trusted administrative hosts can connect
• Audit all FalkorDB deployments to confirm whether the Bolt endpoint has been enabled

Patch Information

FalkorDB resolved the issue in release v4.20.0. The fix, tracked in Pull Request #2170 and landed via commit 0b11a00b, removes Bolt protocol support from the codebase, eliminating the vulnerable BoltReadHandler function and associated APIs.

Workarounds

• Leave BOLT_PORT unset so FalkorDB does not open the vulnerable listener, which is the default configuration
• Place FalkorDB behind a network perimeter that blocks inbound connections to the Bolt port from untrusted networks
• Terminate client connectivity on an authenticated proxy and forward only validated traffic to the database host

# Example: block external access to the Bolt port with iptables
# Replace 7687 with the actual BOLT_PORT value if customized
iptables -A INPUT -p tcp --dport 7687 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7687 -j DROP