CVE-2026-7826
CriticalCVSS 9.1Summary
A vulnerability in FalkorDB before 4.18.4 causes a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function. A remote attacker who can issue Redis replication commands (e.g., against an instance with no password) can send a crafted RDB stream with a sub-buffer length field exceeding the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
Risk Assessment
The attack can lead to denial of service or disclosure of heap memory, potentially exposing sensitive data. Organizations may face service disruption or information leakage.
Recommendation
Update FalkorDB to version 4.18.4 or later. Additionally, configure Redis authentication to restrict replication command access.
Other vulnerabilities in FalkorDB
See all- CVE-2026-7827High
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders in FalkorDB before 4.18.4. A remote attacker who can issue Redis replication commands can send a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.
- CVE-2026-5759Critical
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders in FalkorDB before 4.18.1. A remote attacker who can issue Redis replication commands can send a crafted RDB stream where the deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
- CVE-2026-88412Medium
An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-88411High
Improper error handling in the GRAPH.EFFECT component in FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.
- CVE-2026-88410High
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.
- CVE-2026-88409High
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-88408Medium
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-88407High
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2026-88406High
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Original NVD description (English source)
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS