Executive brief
FalkorDB is a graph database module for Redis. The vulnerability allows authenticated users to crash the FalkorDB process by sending a specially crafted query with an extremely large RETURN projection list, causing a stack overflow that terminates the service and loses unperisted data.
Technical details
The _ValidateUnion_Clauses function in ast_validations.c declares a variable-length array (VLA) on the stack sized directly by the untrusted projection count from the parsed GRAPH.QUERY command, with no upper limit enforced. An attacker with valid authentication and GRAPH.QUERY permission can craft a query with millions of projections to exhaust the thread stack, triggering SIGSEGV and process termination.
Affected products
- FalkorDB FalkorDB 4.20.1 to 4.20.4
Timeline
- 2026-08-05: disclosed: Reported to security@falkordb.com by external researcher
- 2026-09-21: advisory