Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T21:17:14.733Z",
  "pubdate": "2026-09-21T21:17:14.733Z",
  "executiveSummary": "A stack overflow vulnerability exists in FalkorDB (a Redis module) within versions 4.20.1 through 4.20.4.\nThe vulnerability resides in the _ValidateUnion_Clauses function located in /ast/ast_validations.c.\nAn unauthenticated or authenticated attacker can leverage this flaw to trigger a stack overflow by submitting a maliciously crafted input, resulting in a Denial of Service (DoS) condition.\nThe vulnerability occurs due to improper handling of complex or deeply nested query structures during the abstract syntax tree validation phase.\nSuccessful exploitation leads to the abnormal termination of the Redis process, impacting service availability.\nNo specific privilege requirements are explicitly noted, suggesting potential exposure depending on the accessibility of the FalkorDB instance.\nRisk implications include potential service disruption, affecting systems relying on FalkorDB for data processing and graph operations.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the _ValidateUnion_Clauses function during the processing of graph query AST (Abstract Syntax Tree) validations.\nWhen FalkorDB parses an incoming query, the _ValidateUnion_Clauses function is invoked to perform recursive validation of union clauses. The implementation fails to adequately constrain the recursion depth or validate the size of the stack frames created during this traversal.\nThe attack flow begins when an attacker transmits a crafted query containing deeply nested or excessively complex union operations. As the parser recursively descends into the nested structure to validate the clauses, it consumes stack memory proportionate to the depth and complexity of the provided input.\nBecause the function does not implement stack depth limiting or sufficient input sanitization to prevent deep recursion, the memory consumption exceeds the allocated stack space for the thread.\nThe resulting stack overflow overwrites adjacent memory, leading to an immediate segmentation fault or memory corruption, which forces the Redis process to crash.\nThe component affected is specifically the AST validation logic in /ast/ast_validations.c, which is responsible for ensuring query integrity before execution. By providing input that bypasses logical depth checks, an attacker forces the application into a state where the execution context is destroyed.\nAffected versions include 4.20.1, 4.20.2, 4.20.3, and 4.20.4. The vulnerability is triggered during the query parsing and validation phase, which occurs before execution. Consequently, the attacker does not need to have existing read or write access to the underlying data, only the ability to submit queries to the Redis instance.\nPost-exploitation, the primary impact is a persistent Denial of Service. In environments where the Redis service is configured to automatically restart, an attacker may be able to repeatedly trigger the crash to maintain a state of sustained unavailability. There is no evidence currently suggesting that this specific overflow can be leveraged for remote code execution, as the immediate crash is typically triggered by the stack exhaustion itself before further control flow diversion can be established."
}