EUVD-2026-84191
GHSA-cj49-r9g5-5mcw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable database requiring a crafted graph query, so AV:N/AC:L; PR:L reflects that a query-issuing client is needed (PR:N only for unauthenticated Redis); impact is availability-only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Articles & Coverage 1
AnalysisAI
A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to a Redis instance that has the FalkorDB module loaded (versions v4.20.1 through v4.20.4) and the ability to submit a crafted graph query that exercises the node_token_count/relation_token_count code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, availability-only flaw - an out-of-bounds read that crashes the FalkorDB module and thus the hosting Redis process (DoS). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version for CVE-2026-88407 is identified anywhere in the provided data - the sole reference is the upstream GitHub issue https://github.com/FalkorDB/FalkorDB/issues/2328, which should be monitored for the fix commit and the first patched release, after which the module should be upgraded and Redis restarted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FalkorDB 4.20.1 through 4.20.4 deployments and their hosting Redis instances, determine which are network-accessible, and immediately restrict exposure to trusted hosts or networks; enforce Redis requirepass and ACLs, remove unauthenticated access, and limit graph-query privileges to only necessary users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today