Description

An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T21:17:15.513Z",
  "pubdate": "2026-09-21T21:17:15.513Z",
  "executiveSummary": "An integer overflow vulnerability exists in the _BulkInsert_ReadProperty component of FalkorDB version 4.20.1.\nThe vulnerability is triggered when the application processes specifically crafted inputs, leading to an integer overflow condition during property reading operations.\nSuccessful exploitation allows a remote attacker to cause a Denial of Service (DoS) by crashing the affected Redis module.\nThis issue impacts the stability and availability of the FalkorDB instance, as the overflow condition disrupts memory management and execution flow within the bulk insertion logic.\nNo authentication or elevated privileges are explicitly required to trigger the overflow if the attacker has access to the interface responsible for bulk data ingestion.\nThe risk is significant for high-availability environments where consistent uptime is critical, as a malformed payload can force an abrupt termination of the process.",
  "technicalDetails": "The vulnerability resides within the _BulkInsert_ReadProperty function located in the bulk_insert.c source file of the FalkorDB Redis module.\nThe flaw manifests during the deserialization or parsing of bulk-inserted data properties. When the input processing logic performs arithmetic operations on user-supplied length or size parameters without adequate bounds checking or overflow validation, an integer overflow occurs.\nSpecifically, when the calculated size exceeds the maximum capacity of the integer type used for memory allocation or loop iteration, the value wraps around to a small positive number or a negative value.\nThis invalid size calculation leads to heap-based buffer mismanagement, such as undersized memory allocations followed by out-of-bounds writes or memory corruption, which subsequently triggers an unhandled exception or segment fault in the Redis process.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious payload containing crafted property length fields designed to induce the overflow state. 2) The payload is transmitted to the FalkorDB instance via the bulk insertion interface. 3) The _BulkInsert_ReadProperty component reads the corrupted length value during the parsing phase. 4) The module attempts to allocate memory or iterate based on the overflowed integer, resulting in a system crash. 5) The failure of the Redis module process results in a Denial of Service, rendering the database inaccessible for subsequent requests.\nBecause this component handles structured data input, the flaw is inherently exposed to any client authorized to perform bulk write operations. The exploitation does not require advanced memory layout manipulation or ROP chain construction, as the primary impact is the immediate instability and crashing of the module service, characteristic of a resource management failure under unexpected input conditions."
}