CVE-2026-88406: FalkorDB Redis Module Stack Overflow DoS

CVE-2026-88406 Overview

CVE-2026-88406 is a stack overflow vulnerability [CWE-121] in FalkorDB, a graph database implemented as a Redis module. The flaw resides in the _ValidateUnion_Clauses function within /ast/ast_validations.c. Affected releases include FalkorDB versions v4.20.1 through v4.20.4. An attacker can submit a crafted query that triggers the stack overflow during AST (Abstract Syntax Tree) validation, causing the Redis process hosting the module to crash. The result is a Denial of Service (DoS) condition against the database instance. Exploitation requires no authentication or user interaction when the module is exposed over the network.

Critical Impact
A remote, unauthenticated attacker can crash FalkorDB instances by submitting a malformed query, disrupting availability of any application relying on the database.

Affected Products

FalkorDB (Redis module) v4.20.1
FalkorDB (Redis module) v4.20.2 and v4.20.3
FalkorDB (Redis module) v4.20.4

Discovery Timeline

2026-09-21 - CVE-2026-88406 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88406

Vulnerability Analysis

FalkorDB parses incoming Cypher-style queries into an Abstract Syntax Tree before execution. The _ValidateUnion_Clauses function in /ast/ast_validations.c validates UNION clauses within that tree. When processing specially crafted input, the function consumes more stack space than the runtime allocates, corrupting the call stack. The corruption terminates the hosting Redis process, denying service to all clients connected to that instance. Because FalkorDB runs inside Redis, the crash also removes any other modules or datasets loaded in the same process.

Root Cause

The root cause is unbounded recursion or excessive stack allocation during validation of UNION clauses [CWE-121]. The function does not enforce a depth limit or use heap-based iteration when traversing nested query structures. Attackers supply deeply nested or recursive UNION constructs to exhaust the stack.

Attack Vector

Exploitation occurs over the network against any Redis endpoint that has the FalkorDB module loaded. The attacker connects to the Redis port and issues a single crafted graph query. No credentials are required when the instance is reachable and unauthenticated, which is the default in many deployments. The impact is limited to availability; confidentiality and integrity are not affected.

No public proof-of-concept code has been released. See the FalkorDB GitHub Issue #2329 for maintainer-tracked technical details.

Detection Methods for CVE-2026-88406

Indicators of Compromise

Unexpected Redis process crashes or restarts on hosts running the FalkorDB module.
Segmentation faults referencing _ValidateUnion_Clauses or ast_validations.c in Redis logs or core dumps.
Client-side connection resets immediately following submission of graph queries containing nested UNION clauses.

Detection Strategies

Monitor Redis server logs for abnormal termination signals such as SIGSEGV correlated with FalkorDB query traffic.
Inspect query telemetry for graph statements containing unusually deep or repetitive UNION clause structures.
Track process uptime metrics on Redis nodes hosting FalkorDB to identify repeated crash-restart patterns.

Monitoring Recommendations

Forward Redis and FalkorDB logs to a centralized logging platform and alert on crash signatures referencing AST validation.
Baseline normal query volume and syntax patterns so anomalous UNION-heavy payloads generate alerts.
Enable network flow monitoring on the Redis port (default 6379) to identify unauthenticated external connections.

How to Mitigate CVE-2026-88406

Immediate Actions Required

Restrict network access to Redis instances hosting FalkorDB to trusted application hosts only using firewall rules or bind directives.
Enable Redis authentication with requirepass and enforce ACLs to reject anonymous graph queries.
Audit deployed FalkorDB module versions and identify all instances running v4.20.1 through v4.20.4.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Monitor the FalkorDB GitHub Issue #2329 for maintainer updates and upgrade to a patched release as soon as one is published.

Workarounds

Place FalkorDB behind a network segmentation boundary that blocks direct client access from untrusted networks.
Deploy a query proxy or application-layer filter that rejects graph queries containing deeply nested UNION clauses.
Configure process supervisors to automatically restart Redis on crash while investigation and patching proceed.

bash

# Configuration example: restrict Redis network exposure and require auth
bind 127.0.0.1 10.0.0.5
protected-mode yes
requirepass <strong-random-secret>
# Optional: block direct external access at the host firewall
iptables -A INPUT -p tcp --dport 6379 ! -s 10.0.0.0/24 -j DROP