FalkorDB vulnerabilities
We track 9 vulnerabilities in FalkorDB products across 3 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.
Latest FalkorDB vulnerabilities
- 7.5 High severity
FalkorDB: Access of Resource Using Incompatible Type
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The functi
- 8.1 High severity
FalkorDB: Improper Authentication
An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whet
- 9.1 Critical severity
FalkorDB: Out-of-bounds Write
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memo
- 9.8 Critical severity
FalkorDB: Out-of-bounds Write
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an a
- 8.1 High severity
FalkorDB: Stack-based Buffer Overflow
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an ins
- 9.1 Critical severity
FalkorDB: Out-of-bounds Read
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password con
- 9.8 Critical severity
FalkorDB: Double Free
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for e
- 8.2 High severity
QueryWeaver: Incorrect Authorization
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates an
- 9.8 Critical severity
FalkorDB Browser: Improper Limitation of a Pathname to a Restricted Directory
FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution.