Quick answers
- Is CVE-2026-88411 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-88411 being exploited in the wild.
- How severe is CVE-2026-88411?
- High severity, with a CVSS score of 7.5, published 21 September 2026.
- Which products and versions are affected?
- FalkorDB v4.20.1.
- Is there a fix for CVE-2026-88411?
- A patch was published on 2026-08-04: Fix merged in PR #2247 on August 4, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-88411 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-88411?
- Check whether you run FalkorDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in effects_apply.c where consistency checks (entity-not-found, schema/attribute-already-exists, unknown effect type) were previously debug-only assertions that could fall through to undefined behavior in release builds. The fix hardens these checks into always-on error handling that properly reports failure. An attacker with network access to the Redis instance can send specially crafted GRAPH.EFFECT commands to trigger improper error handling, leading to denial of service.
Affected products
- FalkorDB FalkorDB v4.20.1
Timeline
- 2026-09-21: disclosed
- 2026-08-04: patched: Fix merged in PR #2247 on August 4, 2026