CVE-2026-88406 in FalkorDB
Summary
by MITRE • 09/22/2026
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
FalkorDB, an open-source graph database module designed for Redis, versions 4.20.1 through 4.20.4, contains a critical stack overflow vulnerability located within the _ValidateUnion_Clauses function in the source file ast_validations.c. This flaw arises from insufficient validation of input data during the parsing and processing of complex graph query structures, specifically those involving union operations. When an attacker submits a specially crafted request containing deeply nested or excessively large union clauses, the application fails to properly bound its recursive calls or iterative checks against available stack space. Consequently, this leads to a rapid exhaustion of the thread's allocated memory on the call stack, triggering a segmentation fault and causing the FalkorDB process to crash immediately upon execution of the malformed query.
The operational impact of this vulnerability is primarily centered around Denial of Service (DoS). Since FalkorDB operates as an in-memory database module within the Redis ecosystem, its availability is critical for applications relying on real-time graph analytics or relationship-based data retrieval. A successful exploitation allows a remote attacker to disrupt service continuity by forcing the database process to terminate unexpectedly. This results in immediate loss of connectivity for all connected clients and requires manual intervention or automated restart mechanisms to restore functionality. In environments where high availability is paramount, such as financial trading platforms or real-time recommendation engines, this interruption can lead to significant data processing delays, transaction failures, and potential cascading failures across dependent services that expect consistent database uptime.
From a technical classification perspective, this vulnerability aligns with CWE-121, which denotes a stack-based buffer overflow resulting from unbounded memory writes relative to the stack pointer's limits during execution flow control. The attack vector is classified under MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via application exhaustion or resource consumption. Although the primary outcome is service disruption rather than arbitrary code execution, the underlying mechanism involves manipulating program state through malformed input that exceeds expected bounds, a hallmark of memory corruption vulnerabilities. The lack of proper depth limiting in recursive validation routines for union clauses represents a fundamental design oversight in how query complexity is assessed before execution planning begins.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the FalkorDB instance to version 4.20.5 or later, where this specific validation logic has been patched to enforce strict limits on recursion depth and input size during clause validation. For environments unable to patch immediately due to compatibility constraints, deploying a Web Application Firewall (WAF) with rules capable of detecting abnormally large query payloads or deeply nested structural patterns can provide an additional layer of defense by blocking requests before they reach the database engine. Additionally, configuring Redis and FalkorDB processes with appropriate memory limits and enabling automatic restart policies via systemd or supervisor tools can help minimize downtime duration following a crash event while ensuring that transient service interruptions do not persist indefinitely without operator awareness.