CVE-2026-88408: FalkorDB Redis Module DoS Vulnerability

CVE-2026-88408 Overview

CVE-2026-88408 is a stack overflow vulnerability in FalkorDB, a graph database implemented as a Redis module. The flaw resides in the _GetGroup() function located in /ops/op_aggregate.c. Affected versions range from v4.20.1 through v4.20.4. An authenticated attacker with network access can send crafted input to trigger the stack overflow and cause a denial of service (DoS) condition. The vulnerability is categorized under [CWE-121] Stack-based Buffer Overflow. Successful exploitation crashes the FalkorDB module, disrupting availability of the graph database service running inside Redis.

Critical Impact
A crafted query processed by _GetGroup() triggers a stack overflow that terminates the FalkorDB Redis module, causing service-wide denial of service for dependent applications.

Affected Products

FalkorDB Redis module v4.20.1
FalkorDB Redis module versions between v4.20.1 and v4.20.4
FalkorDB Redis module v4.20.4

Discovery Timeline

2026-09-21 - CVE-2026-88408 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88408

Vulnerability Analysis

The vulnerability affects the aggregate operation handling in FalkorDB. When the graph query engine processes an aggregation, execution reaches _GetGroup() inside /ops/op_aggregate.c. Crafted input consumed by this function exhausts stack space and produces a stack-based buffer overflow. The process hosting the Redis module crashes, terminating all client sessions and halting graph query processing.

The attack requires network access and low-privileged authentication to the Redis instance loading FalkorDB. No user interaction is needed, and exploitation complexity is low. Impact is restricted to availability; confidentiality and integrity are not directly affected based on the CVSS vector.

See the GitHub Issue Discussion for the reported reproduction context.

Root Cause

The root cause is unbounded recursion or unchecked stack allocation inside _GetGroup() when constructing or resolving aggregation groups. Attacker-controlled query structure drives the function to consume stack frames beyond safe limits. FalkorDB does not validate the depth or size of grouping input prior to processing, allowing the crafted query to overflow the process stack.

Attack Vector

An authenticated client submits a specially crafted Cypher query containing an aggregation clause that forces _GetGroup() into a stack-exhausting execution path. Because FalkorDB runs as a Redis module inside the Redis server process, the resulting crash takes down the entire Redis instance, not just the graph workload. Multi-tenant Redis deployments hosting FalkorDB are exposed to service-wide outages from a single malicious client.

No verified public exploit code is available. The vulnerability mechanism is described in prose based on the vendor issue tracker; refer to the GitHub Issue Discussion for technical details.

Detection Methods for CVE-2026-88408

Indicators of Compromise

Unexpected Redis process termination or restart events on hosts loading the FalkorDB module.
Segmentation fault (SIGSEGV) entries in system logs correlated with FalkorDB query execution.
Client connection resets from Redis coincident with the receipt of Cypher aggregation queries.

Detection Strategies

Monitor Redis server logs for abnormal termination messages and crash traces referencing op_aggregate or _GetGroup.
Inspect Cypher query telemetry for unusually deep or malformed aggregation clauses submitted by authenticated clients.
Alert on repeated Redis process restarts within short intervals on hosts running FalkorDB v4.20.1 through v4.20.4.

Monitoring Recommendations

Enable core dump collection on Redis hosts to capture crash artifacts for forensic analysis.
Ingest Redis and FalkorDB logs into a centralized logging platform and build availability dashboards.
Track authenticated client identities issuing aggregation-heavy queries to attribute abusive activity.

How to Mitigate CVE-2026-88408

Immediate Actions Required

Inventory all Redis instances loading the FalkorDB module and identify hosts running versions v4.20.1 through v4.20.4.
Restrict Redis network exposure to trusted application tiers using firewall rules or network policies.
Enforce Redis authentication and rotate credentials to limit which principals can submit queries.

Patch Information

At the time of publication, no fixed version is listed in the NVD record. Track the GitHub Issue Discussion and the FalkorDB project releases for a patched module version, and upgrade as soon as a fix is available.

Workarounds

Disable or unload the FalkorDB module on Redis instances that do not require graph functionality.
Apply Redis ACL rules to prevent low-trust accounts from executing GRAPH.QUERY and related FalkorDB commands.
Deploy a query proxy that inspects Cypher input and rejects aggregation clauses exceeding sane depth or size thresholds.

bash

# Configuration example: restrict FalkorDB commands via Redis ACL
ACL SETUSER appuser on >StrongPasswordHere ~* -@all +@read +@connection
ACL SETUSER appuser -GRAPH.QUERY -GRAPH.RO_QUERY -GRAPH.PROFILE