Falkordb
Monthly
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
A crafted bulk-insert payload triggers an integer overflow in FalkorDB's _BulkInsert_ReadProperty parser (/bulk_insert.c), crashing the module and taking down the Redis process that hosts it, for a denial-of-service condition in v4.20.1. The assessed CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) means remote, unauthenticated, no-interaction exploitation with availability-only impact; in practice the effective bar depends on whether the Redis deployment enforces requirepass or ACL authentication, which would raise the requirement to valid credentials. No public exploit code identified at time of analysis, no CISA KEV listing, and the sole reference is the vendor GitHub issue FalkorDB/FalkorDB#2326 - consistent with an independent assessment of a moderate-severity, availability-only issue of low real-world priority.
Authenticated denial of service in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a user with query access to crash the database process by submitting a crafted graph query that reaches the aggregation code path handling GROUP operations. The flaw is a stack overflow in the _GetGroup() function in /ops/op_aggregate.c, scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning low-complexity remote exploitation but requiring prior authentication (PR:L), with impact limited to availability and no confirmed data exposure or code execution. There is no public exploit identified at time of analysis and no confirmed vendor patch version in the provided references, so exposure is bounded by who can reach the query interface and by the narrow 4.20.1-4.20.4 version window.
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
Missing write-command registration for graph.UDF in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a client that is already authenticated and authorized to issue module commands (CVSS PR:L, unauthenticated external attackers are not sufficient) to invoke a command that Redis does not treat as a write, producing incorrect behavior in deployments whose correctness depends on write-command semantics such as replication propagation, persistence, and replica handling. The assessed impact is primarily availability (A:H) with a minor integrity effect (I:L) and explicitly no confidentiality impact (C:N), giving a CVSS of 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exposed version range is narrow. Note that the supplied 'Information Disclosure' tag is not supported by the assessed vector, which sets C:N and attributes risk almost entirely to availability.
A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
A crafted bulk-insert payload triggers an integer overflow in FalkorDB's _BulkInsert_ReadProperty parser (/bulk_insert.c), crashing the module and taking down the Redis process that hosts it, for a denial-of-service condition in v4.20.1. The assessed CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) means remote, unauthenticated, no-interaction exploitation with availability-only impact; in practice the effective bar depends on whether the Redis deployment enforces requirepass or ACL authentication, which would raise the requirement to valid credentials. No public exploit code identified at time of analysis, no CISA KEV listing, and the sole reference is the vendor GitHub issue FalkorDB/FalkorDB#2326 - consistent with an independent assessment of a moderate-severity, availability-only issue of low real-world priority.
Authenticated denial of service in the FalkorDB Redis module versions 4.20.1 through 4.20.4 allows a user with query access to crash the database process by submitting a crafted graph query that reaches the aggregation code path handling GROUP operations. The flaw is a stack overflow in the _GetGroup() function in /ops/op_aggregate.c, scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning low-complexity remote exploitation but requiring prior authentication (PR:L), with impact limited to availability and no confirmed data exposure or code execution. There is no public exploit identified at time of analysis and no confirmed vendor patch version in the provided references, so exposure is bounded by who can reach the query interface and by the narrow 4.20.1-4.20.4 version window.