CVE-2026-88408 in FalkorDB
Summary
by MITRE • 09/22/2026
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
FalkorDB, an open-source graph database module for Redis, versions 4.20.1 through 4.20.4 are susceptible to a critical stack overflow vulnerability located within the _GetGroup() function in the source file ops/op_aggregate.c. This flaw arises from improper handling of input data during aggregation operations, specifically when processing group-by clauses or similar grouping mechanisms inherent to graph query execution. The vulnerability is classified under CWE-121, which denotes a stack-based buffer overflow, indicating that the application fails to properly validate the size or structure of incoming parameters before copying them onto the call stack. In high-performance database engines like FalkorDB, where recursive functions and deep call stacks are common during complex query execution, such an oversight can lead to immediate memory corruption when the input exceeds expected bounds.
The operational impact of this vulnerability is primarily a Denial of Service (DoS). An attacker who has access to execute queries against the vulnerable instance can craft specific inputs that trigger excessive stack usage or overwrite critical return addresses and local variables on the stack. This results in application crashes, leading to service unavailability for legitimate users. In the context of Redis modules, which often handle persistent connections and high-throughput requests, a crash may also result in data loss if transactions are not properly rolled back due to abrupt termination. Furthermore, depending on the specific compiler optimizations and runtime environment, stack overflows can sometimes be leveraged for arbitrary code execution, although the reported impact focuses on availability disruption. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, where attackers aim to disrupt or deny service to legitimate users by exhausting resources or crashing systems.
Mitigation strategies should prioritize immediate patching to version 4.20.5 or later, which addresses the bounds checking issues within the aggregation operations. Until an update is applied, administrators can implement network-level controls such as rate limiting and input size restrictions on Redis connections to prevent oversized queries from reaching the vulnerable module functions. Additionally, enabling stack protection mechanisms like Stack Canaries in the compilation process of FalkorDB can help detect corruption attempts before they lead to exploitable conditions. Regular security audits focusing on C/C++ memory management practices are recommended to identify similar vulnerabilities in other modules or future updates, ensuring robust defense-in-depth against both availability and potential confidentiality or integrity compromises.