The vulnerability is an out‑of‑bounds read in the node_token_count/relation_token_count component of FalkorDB (a Redis module). When an attacker supplies crafted input, the module attempts to read beyond allocated memory, causing a crash that results in a denial of service. No remote code execution or data exfiltration is possible as described. The impact is a loss of availability rather than confidentiality or integrity. The weakness is an incorrect buffer boundary check and is classified as a buffer overread.

Versions of FalkorDB from 4.20.1 through 4.20.4 are affected. The issue appears in the node_token_count and relation_token_count components of the Redis module. No other vendors or products are mentioned in the CVE data.

The CVSS score of 7.5 indicates a high severity of the vulnerability. The EPSS score of 0.0046 (0.46%) indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is through a crafted Redis command sent to a FalkorDB instance; an attacker with network or application access can send the vulnerable input. If successful, the module will crash, resulting in a denial of service that affects the entire FalkorDB service. No privilege escalation or data compromise is reported.