Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T21:17:15.120Z",
  "pubdate": "2026-09-21T21:17:15.120Z",
  "executiveSummary": "A critical buffer overflow vulnerability exists in the FalkorDB Redis module, specifically affecting versions 4.20.1 through 4.20.4.\nThe vulnerability resides within the _Decode_GrB_Matrix function, which is responsible for processing GraphBLAS matrix structures.\nBy submitting a maliciously crafted input to this function, an unauthenticated or authenticated attacker can trigger an out-of-bounds memory write, resulting in a Denial of Service (DoS) condition by crashing the Redis server process.\nThe flaw represents a significant risk to service availability and system stability, as it allows remote attackers to disrupt database operations without requiring high-level privileges.\nExploitation does not necessarily require complex environmental conditions, as the failure occurs during the standard decoding process of incoming matrix data, making any interface that accepts GraphBLAS input a potential vector for exploitation.",
  "technicalDetails": "The root cause of this vulnerability is an improper bounds check within the _Decode_GrB_Matrix function located in /v19/decode_matrix.c. During the deserialization or decoding phase of matrix objects using the GraphBLAS framework, the function fails to validate the size of the input data against the allocated destination buffer.\nWhen a crafted payload is processed, the function attempts to write data beyond the designated memory boundary. This uncontrolled write leads to memory corruption, specifically overwriting adjacent heap segments or internal control structures associated with the Redis module process.\nThe attack flow begins when an attacker sends a serialized matrix object via the client-server protocol utilized by FalkorDB. The server, upon receiving the command, triggers the _Decode_GrB_Matrix function to reconstruct the matrix structure. The vulnerable function performs insufficient validation on the input metadata that dictates the copy length. An attacker can manipulate these length parameters to exceed the allocated buffer size.\nBecause the vulnerability occurs within the memory management logic of the decoding routine, the resulting overflow typically results in a SIGSEGV (segmentation fault) or an unrecoverable memory state, causing an immediate crash of the Redis process. This Denial of Service is effective because it forces an abrupt termination of the service, necessitating a restart of the Redis instance to restore functionality.\nThis vulnerability affects FalkorDB Redis module versions 4.20.1, 4.20.2, 4.20.3, and 4.20.4. The exploitation is possible whenever the module is exposed to untrusted input sources. In environments where the module is configured to process complex graph operations, the exposure is heightened as the decoding logic is frequently invoked for standard data ingestion tasks. There is no requirement for specific administrative privileges to initiate this attack, provided the attacker has connectivity to the FalkorDB instance and access to the specific commands that trigger the matrix decoding path."
}