CVE-2026-107911

{
  "etk_id": "ETK-2026-1052",
  "cve_id": "CVE-2026-107911",
  "display_id": "CVE-2026-107911",
  "ghsa_id": "GHSA-g4x7-54hf-p7f3",
  "euvd_id": "EUVD-2026-95488",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Type confusion in FalkorDB query flag handling",
  "summary": "FalkorDB versions before 4.20.0 mishandle a query flag during command processing. An authenticated client permitted to run GRAPH.QUERY may disrupt service and could expose or corrupt process memory. Disabling the Bolt endpoint does not remove the affected parsing behavior.",
  "mitigation": "Upgrade FalkorDB to version 4.20.0 or later. Restrict GRAPH.QUERY access to trusted authenticated users until the upgrade is complete.",
  "vendor": "FalkorDB",
  "product": "FalkorDB",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.20.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.20.0"
      ],
      "package_name": "FalkorDB",
      "purl": null
    }
  ],
  "cwes": [
    843
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2762,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 86.76998376666667,
  "t0_at": "2026-10-09T05:08:14.899000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T05:08:14.899000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T05:08:14.899000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107911"
    }
  }
}