{"id":"CVE-2026-107911","title":"A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or cor…","summary":"A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or cor…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-843"],"published":"2026-10-09","updated":"2026-10-09","sourceUpdated":"2026-10-09T06:17:12.733","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107911","references":[{"url":"https://github.com/FalkorDB/FalkorDB/commit/0b11a00b34b25c4d4fdfe55f0a35c8a00593bd7d","label":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},{"url":"https://github.com/FalkorDB/FalkorDB/pull/2170","label":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},{"url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.20.0","label":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"}],"tags":["nvd"],"ingestedAt":"2026-10-09T06:27:05.590Z","slug":"CVE-2026-107911","body":"## Overview\n\nA type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}