CVE-2026-88407: FalkorDB Redis Module DoS Vulnerability

CVE-2026-88407 Overview

CVE-2026-88407 is an out-of-bounds read vulnerability in the node_token_count and relation_token_count components of FalkorDB, a graph database module for Redis. The flaw affects FalkorDB versions v4.20.1 through v4.20.4. A remote attacker can send a crafted input to the Redis module and trigger a Denial of Service (DoS) condition. No authentication or user interaction is required to exploit the issue, and the attack is executable over the network.

Critical Impact
Unauthenticated attackers can crash FalkorDB instances remotely by submitting malformed graph queries, disrupting availability of any application relying on the affected module.

Affected Products

FalkorDB Redis module v4.20.1
FalkorDB Redis module v4.20.2 and v4.20.3
FalkorDB Redis module v4.20.4

Discovery Timeline

2026-09-21 - CVE-2026-88407 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88407

Vulnerability Analysis

The vulnerability resides in the token counting logic of FalkorDB, specifically within the node_token_count and relation_token_count routines. These functions parse graph elements supplied through user queries. When the module processes a crafted input, it reads memory outside the intended buffer boundaries. The invalid read causes the Redis process hosting the module to terminate abnormally, resulting in a Denial of Service. Because FalkorDB extends Redis with graph query capabilities, any client able to submit a query to the database can trigger the crash.

Root Cause

The root cause is missing or inadequate bounds validation on token counters that walk graph query structures. The affected functions assume input tokens conform to expected sizes and offsets. When a crafted payload violates that assumption, the code dereferences memory beyond the allocated region. This class of defect is classified as an Out-of-Bounds Read.

Attack Vector

An attacker sends a specially crafted graph query to a network-reachable FalkorDB instance. The affected token counting path executes during query parsing, before any authorization decision. The out-of-bounds read corrupts execution state or causes a segmentation fault, terminating the Redis server process. No credentials, no user interaction, and no elevated privileges are needed. See the upstream tracking issue for reproduction details: FalkorDB GitHub Issue #2328.

Detection Methods for CVE-2026-88407

Indicators of Compromise

Unexpected Redis or FalkorDB process crashes with segmentation fault signatures in system logs.
Repeated client disconnects immediately following graph query submissions from a single source IP.
FalkorDB module load messages appearing frequently in Redis logs, indicating repeated restarts after crashes.

Detection Strategies

Inspect Redis server logs for abnormal termination events correlated with inbound graph queries targeting node_token_count or relation_token_count code paths.
Monitor for anomalous query patterns containing malformed graph token structures directed at Redis port 6379 or custom-configured ports.
Deploy network-level detection for repeated connections that immediately precede service restarts.

Monitoring Recommendations

Enable Redis persistence and crash logging to capture stack traces at the point of failure.
Track FalkorDB module version across all Redis nodes and alert when versions v4.20.1 through v4.20.4 are detected.
Instrument query telemetry to record client identifiers and payload sizes for FalkorDB commands.

How to Mitigate CVE-2026-88407

Immediate Actions Required

Identify all Redis instances running FalkorDB module versions v4.20.1 through v4.20.4.
Restrict network access to FalkorDB endpoints using firewall rules or Redis bind directives, permitting only trusted application hosts.
Enable Redis authentication with requirepass and, where supported, ACL rules to limit which clients can submit graph queries.

Patch Information

Refer to the upstream project tracker at FalkorDB GitHub Issue #2328 for the current fix status and remediated release. Upgrade to a FalkorDB version that resolves the out-of-bounds read in the node_token_count and relation_token_count components once available.

Workarounds

Place FalkorDB behind a query proxy that validates or rejects malformed graph inputs before forwarding them to Redis.
Disable exposure of the FalkorDB module on production nodes if graph queries are not required by dependent applications.
Isolate FalkorDB workloads on dedicated Redis instances so that crashes do not disrupt unrelated Redis-backed services.

bash

# Configuration example: restrict Redis exposure and require authentication
bind 127.0.0.1 10.0.0.5
protected-mode yes
requirepass <strong-shared-secret>
# Limit clients allowed to run FalkorDB graph commands
acl setuser appuser on >app-secret ~* +@read +graph.query +graph.ro_query