Executive brief
FalkorDB is a graph database module for Redis that stores and queries network data. An out-of-bounds read vulnerability in the GRAPH.BULK command allows authenticated attackers to crash the database server and cause data loss by sending specially crafted input that exceeds the bounds of the command's argument vector. This requires valid database credentials and permissions to execute GRAPH.BULK commands.
Technical details
The BulkInsert() function parses node_token_count and relation_token_count parameters from command arguments and uses them as loop bounds to iterate over argv[] without first validating that argc contains sufficient elements, leading to an out-of-bounds memory read. The vulnerability occurs in the _BulkInsert_ValidateTokens calls which dereference argv entries beyond the actual argument count, triggering a SIGSEGV. The existing ASSERT checks that should catch this occur after the vulnerable code and are disabled in release builds, providing no protection.
Affected products
- FalkorDB FalkorDB v4.20.1 to v4.20.4
Timeline
- 2026-09-21: disclosed: Advisory published
- 2026-08-05: other: Reported to security@falkordb.com