Executive brief
FalkorDB is a Redis module that provides graph database functionality. Improper error handling in the GRAPH.EFFECT component can cause the application to crash or become unresponsive, resulting in service unavailability. An attacker can trigger this condition by sending malformed GRAPH.EFFECT commands to a vulnerable FalkorDB instance.
Technical details
The vulnerability exists in effects_apply.c where consistency checks (entity-not-found, schema/attribute-already-exists, unknown effect type) were previously debug-only assertions that could fall through to undefined behavior in release builds. The fix hardens these checks into always-on error handling that properly reports failure. An attacker with network access to the Redis instance can send specially crafted GRAPH.EFFECT commands to trigger improper error handling, leading to denial of service.
Affected products
- FalkorDB FalkorDB v4.20.1
Timeline
- 2026-09-21: disclosed
- 2026-08-04: patched: Fix merged in PR #2247 on August 4, 2026