CVE-2026-107911 Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument

A type confusion vulnerability in the readflags function src/commands/cmddispatcher.c in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any clie...

CVE-2026-107911

A type confusion vulnerability exists in the _read_flags function (src/commands/cmd_dispatcher.c) of FalkorDB before version 4.20.0 . A remote authenticated attacker capable of running GRAPH.QUERY can trigger the flaw because the system accepts a --bolt argument and casts a Redis string object to...