# FalkorDB vulnerabilities

Source: https://junglewise.ai/threats/technologies/falkordb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/falkordb.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 14 vulnerabilities in FalkorDB: 0 in the last 7 days and 14 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-107911, was published on 9 October 2026. Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 4.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 14
- All time: 14 (4 critical, 0 exploited in the wild)

## About FalkorDB

Graph database library designed for storage and querying of graph data structures.

## Latest FalkorDB vulnerabilities

- [CVE-2026-107911: FalkorDB type confusion in _read_flags function](https://junglewise.ai/threats/cve-2026-107911-a-type-confusion-vulnerability-in-the-read-flags-function-src) (high, CVSS 7.5, published 9 Oct 2026)
- [CVE-2026-107910: FalkorDB improper authentication in Bolt endpoint](https://junglewise.ai/threats/cve-2026-107910-an-improper-authentication-vulnerability-in-the-is-authenticated) (high, CVSS 8.1, published 9 Oct 2026)
- [CVE-2026-107909: FalkorDB heap-based buffer overflow in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-107909-a-heap-based-out-of-bounds-write-in-the-ws-read-frame-function) (critical, CVSS 9.1, published 9 Oct 2026)
- [CVE-2026-107908: FalkorDB heap-based buffer overflow in Bolt handler](https://junglewise.ai/threats/cve-2026-107908-a-heap-based-out-of-bounds-write-in-the-boltreadhandler-function) (critical, CVSS 9.8, published 9 Oct 2026)
- [CVE-2026-7827: FalkorDB stack-based buffer overflow in RDB graph entity decoder](https://junglewise.ai/threats/cve-2026-7827-a-stack-based-buffer-overflow-in-the-rdbloadentity-function-of-the) (high, CVSS 8.1, published 9 Oct 2026)
- [CVE-2026-7826: FalkorDB heap-based out-of-bounds read in buffer serializer](https://junglewise.ai/threats/cve-2026-7826-a-heap-based-out-of-bounds-read-in-the-bufferserializeriov2) (critical, CVSS 9.1, published 9 Oct 2026)
- [CVE-2026-5759: FalkorDB double free and use-after-free in RDB graph decoder](https://junglewise.ai/threats/cve-2026-5759-a-double-free-and-use-after-free-vulnerability-in-the) (critical, CVSS 9.8, published 9 Oct 2026)
- [CVE-2026-88412: FalkorDB integer overflow in bulk insert array parsing](https://junglewise.ai/threats/cve-2026-88412-an-integer-overflow-in-the-bulkinsert-readproperty-component-bulk) (medium, CVSS 5.3, published 21 Sep 2026)
- [CVE-2026-88411: FalkorDB GRAPH.EFFECT improper error handling denial of service](https://junglewise.ai/threats/cve-2026-88411-improper-error-handling-in-the-graph-effect-component-effects) (high, CVSS 7.5, published 21 Sep 2026)
- [CVE-2026-88410: FalkorDB graph.UDF write flag missing and uninterruptible execution](https://junglewise.ai/threats/cve-2026-88410-the-graph-udf-in-falkordb-redis-module-v4-20-1-to-v4-20-4-is-not) (high, CVSS 7.1, published 21 Sep 2026)
- [CVE-2026-88409: FalkorDB buffer overflow in GraphBLAS matrix decode](https://junglewise.ai/threats/cve-2026-88409-falkordb-redis-module-v4-20-1-to-v4-20-4-was-discovered-to) (high, CVSS 8.8, published 21 Sep 2026)
- [CVE-2026-88408: FalkorDB stack overflow in _GetGroup function](https://junglewise.ai/threats/cve-2026-88408-falkordb-redis-module-v4-20-1-to-v4-20-4-was-discovered-to) (medium, CVSS 6.5, published 21 Sep 2026)
- [CVE-2026-88407: FalkorDB out-of-bounds read in GRAPH.BULK command](https://junglewise.ai/threats/cve-2026-88407-an-out-of-bounds-read-in-the-node-token-count-relation-token) (high, CVSS 7.5, published 21 Sep 2026)
- [CVE-2026-88406: FalkorDB stack overflow in UNION clause validation](https://junglewise.ai/threats/cve-2026-88406-falkordb-redis-module-v4-20-1-to-v4-20-4-was-discovered-to) (high, CVSS 7.5, published 21 Sep 2026)

## Most severe FalkorDB vulnerabilities

- [CVE-2026-107908: FalkorDB heap-based buffer overflow in Bolt handler](https://junglewise.ai/threats/cve-2026-107908-a-heap-based-out-of-bounds-write-in-the-boltreadhandler-function) (critical, CVSS 9.8, published 9 Oct 2026)
- [CVE-2026-5759: FalkorDB double free and use-after-free in RDB graph decoder](https://junglewise.ai/threats/cve-2026-5759-a-double-free-and-use-after-free-vulnerability-in-the) (critical, CVSS 9.8, published 9 Oct 2026)
- [CVE-2026-107909: FalkorDB heap-based buffer overflow in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-107909-a-heap-based-out-of-bounds-write-in-the-ws-read-frame-function) (critical, CVSS 9.1, published 9 Oct 2026)
- [CVE-2026-7826: FalkorDB heap-based out-of-bounds read in buffer serializer](https://junglewise.ai/threats/cve-2026-7826-a-heap-based-out-of-bounds-read-in-the-bufferserializeriov2) (critical, CVSS 9.1, published 9 Oct 2026)
- [CVE-2026-88409: FalkorDB buffer overflow in GraphBLAS matrix decode](https://junglewise.ai/threats/cve-2026-88409-falkordb-redis-module-v4-20-1-to-v4-20-4-was-discovered-to) (high, CVSS 8.8, published 21 Sep 2026)
- [CVE-2026-7827: FalkorDB stack-based buffer overflow in RDB graph entity decoder](https://junglewise.ai/threats/cve-2026-7827-a-stack-based-buffer-overflow-in-the-rdbloadentity-function-of-the) (high, CVSS 8.1, published 9 Oct 2026)
- [CVE-2026-107910: FalkorDB improper authentication in Bolt endpoint](https://junglewise.ai/threats/cve-2026-107910-an-improper-authentication-vulnerability-in-the-is-authenticated) (high, CVSS 8.1, published 9 Oct 2026)
- [CVE-2026-88411: FalkorDB GRAPH.EFFECT improper error handling denial of service](https://junglewise.ai/threats/cve-2026-88411-improper-error-handling-in-the-graph-effect-component-effects) (high, CVSS 7.5, published 21 Sep 2026)
- [CVE-2026-88407: FalkorDB out-of-bounds read in GRAPH.BULK command](https://junglewise.ai/threats/cve-2026-88407-an-out-of-bounds-read-in-the-node-token-count-relation-token) (high, CVSS 7.5, published 21 Sep 2026)
- [CVE-2026-88406: FalkorDB stack overflow in UNION clause validation](https://junglewise.ai/threats/cve-2026-88406-falkordb-redis-module-v4-20-1-to-v4-20-4-was-discovered-to) (high, CVSS 7.5, published 21 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 14 vulnerabilities in the four before. 0 critical against 4.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 7 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 7 | 4 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FalkorDB vulnerabilities", https://junglewise.ai/threats/technologies/falkordb, 9 November 2026.