Executive brief
FalkorDB is a graph database module for Redis used for storing and querying complex data relationships. A stack overflow vulnerability in the query aggregation function allows attackers to crash the database and cause service downtime by sending specially crafted requests. No user data theft or system compromise is possible, but the denial of service could impact business operations relying on FalkorDB availability.
Technical details
A stack overflow exists in the _GetGroup() function in /ops/op_aggregate.c, triggered by unbounded stack variable-length allocation (VLA) sized by the aggregate key_count parameter. The vulnerability is reachable via crafted aggregate query input without authentication. An attacker can trigger a stack exhaustion leading to process crash and denial of service.
Affected products
- FalkorDB FalkorDB 4.20.1 to 4.20.4
Timeline
- 2026-09-21: disclosed