Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T21:17:14.990Z",
  "pubdate": "2026-09-21T21:17:14.990Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the _GetGroup() function within the FalkorDB Redis module, affecting versions 4.20.1 through 4.20.4.\nThe vulnerability originates from improper bounds checking during the processing of aggregation operations, which can be triggered by a maliciously crafted input provided to the database.\nSuccessful exploitation of this flaw allows a remote or local attacker to induce a Denial of Service (DoS) by causing the application process to crash due to stack corruption.\nThe risk is categorized as critical for availability, as the crash disrupts core database services and prevents legitimate access to graph data.\nThis vulnerability does not strictly require high-level administrative privileges, provided the attacker can reach the input vector for aggregation operations, making it a viable target for service disruption attacks in shared or exposed environments.",
  "technicalDetails": "The vulnerability resides in the _GetGroup() function, located in the source file /ops/op_aggregate.c. This function is responsible for grouping data records during aggregate pipeline execution within the FalkorDB engine.\nThe root cause is a stack overflow condition resulting from the lack of sufficient validation or length checks on input data before it is copied onto the stack during the grouping operation. When an attacker provides a crafted input exceeding the allocated buffer size for group identification or record processing, the excess data overwrites adjacent memory on the stack frame.\nThe attack flow begins when an attacker submits a specific, malformed query or command string that triggers the _GetGroup() routine. The crafted payload is designed to overflow the fixed-size buffer reserved on the stack for handling aggregation metadata. Because the function does not verify the boundaries of the incoming data, the payload overwrites sensitive data, potentially including return addresses or frame pointers.\nUpon the execution of the overflow, the stack integrity is compromised, leading to an immediate segmentation fault (SIGSEGV) and the subsequent termination of the Redis process hosting the FalkorDB module.\nThe vulnerability is present in FalkorDB versions 4.20.1, 4.20.2, 4.20.3, and 4.20.4. Exploitation does not necessarily require authentication if the Redis instance is exposed to the network, though it generally requires the ability to execute aggregation commands against the database.\nWhile the primary documented impact is a Denial of Service, stack-based overflows inherently pose a risk of arbitrary code execution if the payload is expertly crafted to redirect execution flow. However, within the scope of this finding, the documented behavior is the abrupt termination of the process, which disrupts all database operations and leads to a total service outage."
}