Buffer Overflow in FalkorDB Leading to DoS

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: MITRE

Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-88409

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in FalkorDB (a Redis module) versions 4.20.1 to 4.20.4. It occurs in the _Decode_GrB_Matrix function in the decode_matrix.c file. Attackers can exploit this by sending specially crafted input to cause a Denial of Service (DoS) condition.

Impact Analysis

This vulnerability allows attackers to crash the FalkorDB service, leading to service disruption. If exploited, it could cause the Redis server to become unresponsive, affecting applications relying on FalkorDB for graph database operations.

Mitigation Strategies

Upgrade FalkorDB to a version beyond v4.20.4 to address the buffer overflow in the _Decode_GrB_Matrix function. Avoid processing untrusted input in vulnerable versions.

Hi! I’m here to help you understand CVE-2026-88409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70