Description

An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-21T21:17:14.860Z",
  "pubdate": "2026-09-21T21:17:14.860Z",
  "executiveSummary": "FalkorDB versions v4.20.1 through v4.20.4 are susceptible to an out-of-bounds (OOB) read vulnerability located within the node_token_count and relation_token_count components.\nThis vulnerability is classified as an out-of-bounds read, which occurs when the software reads data past the intended boundary of a buffer. The primary impact of this flaw is a Denial of Service (DoS), potentially leading to application crashes or process termination when processing maliciously crafted inputs.\nThe vulnerability affects the core functionality of the FalkorDB Redis module. An attacker capable of sending crafted requests to the database can trigger this memory access violation. The risk implication is significant for availability, as successful exploitation can disrupt database services. No specific authentication or privilege requirements are noted, but network exposure is required to interact with the vulnerable module. Exploitation does not necessarily require advanced capabilities, as the vulnerability is triggered through specifically formatted input data that causes the module to index or read memory outside allocated boundaries.",
  "technicalDetails": "The vulnerability originates from inadequate bounds checking within the internal logic handling node_token_count and relation_token_count in FalkorDB v4.20.1 to v4.20.4. These components appear to be responsible for tracking and processing tokenized entities or relations within the graph database structure.\nRoot Cause Analysis: The flaw stems from a lack of strict validation of input-derived indices or size parameters used to traverse internal data structures. When the affected components process a crafted request, they may calculate an offset or index that falls outside the memory bounds assigned to the respective buffers or arrays. Because the module does not verify that these offsets remain within the valid memory region, it attempts to read memory locations that are adjacent to the intended buffer.\nAttack Flow: An attacker initiates the exploitation by submitting a specially crafted command or input string to the FalkorDB instance. This input is designed to trigger the specific logic within node_token_count or relation_token_count that performs the out-of-bounds access. As the module iterates through tokens or attributes based on the user-supplied values, it reaches a point where the pointer arithmetic exceeds the memory allocation limit for the current structure.\nMemory Access Behavior: The process attempts to read data from an unauthorized segment of the heap or stack. Depending on the memory layout and the nature of the read operation, this often results in a segmentation fault (SIGSEGV) or an equivalent memory access exception, causing the Redis process hosting the FalkorDB module to terminate unexpectedly.\nExploitation Impact: The primary consequence is a Denial of Service (DoS) resulting from the service crash. While this vulnerability is currently categorized as an OOB read, such flaws can sometimes be leveraged for information disclosure if an attacker can control the input to leak sensitive heap pointers or data into the application response, although the primary reported impact is service instability. The requirement for exploitation is the ability to send requests to the Redis interface where the FalkorDB module is active. Because the module is designed to interface with input streams, it is inherently exposed to any client or network entity with access to the Redis port."
}