CVE-2026-88409

Deferred Deferred - Pending Action

Buffer Overflow in FalkorDB Leading to DoS

Publication date: 2026-09-21

Last updated on: 2026-09-22

Assigner: MITRE

Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-22

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-10

NVD

CVE-2026-88409

Affected Vendors & Products

Vendor	Product	Version / Range
falkordb	falkordb	From 4.20.1 (inc) to 4.20.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in FalkorDB (a Redis module) versions 4.20.1 to 4.20.4. It occurs in the _Decode_GrB_Matrix function in the decode_matrix.c file. Attackers can exploit this by sending specially crafted input to cause a Denial of Service (DoS) condition.

Detection Guidance

This vulnerability is specific to FalkorDB (Redis module) versions v4.20.1 to v4.20.4 and involves a buffer overflow in the _Decode_GrB_Matrix function. To detect it, check the installed version of FalkorDB on your system. If it falls within the vulnerable range, update to the latest patched version immediately.

Impact Analysis

This vulnerability allows attackers to crash the FalkorDB service, leading to service disruption. If exploited, it could cause the Redis server to become unresponsive, affecting applications relying on FalkorDB for graph database operations.

Compliance Impact

The vulnerability is a buffer overflow in FalkorDB that allows attackers to cause a Denial of Service (DoS) via crafted input. This could potentially disrupt services handling sensitive data, which may impact compliance with standards like GDPR or HIPAA by compromising availability of critical systems.

Mitigation Strategies

Upgrade FalkorDB to a version beyond v4.20.4 to address the buffer overflow in the _Decode_GrB_Matrix function. Avoid processing untrusted input in vulnerable versions.

Hi! I’m here to help you understand CVE-2026-88409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70