The vulnerability is an out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module). When an attacker provides crafted input, the module attempts to read beyond allocated memory, causing a crash that results in a denial of service. No remote code execution or data exfiltration is possible as described. The impact is a loss of availability rather than confidentiality or integrity. The weakness is an incorrect buffer boundary check and is classified as a buffer overread.

Versions of FalkorDB from 4.20.1 through 4.20.4 are affected. The issue appears in the node_token_count and relation_token_count components of the Redis module. No other vendors or products are mentioned in the CVE data.

The CVSS score of 7.5 indicates a high severity of the vulnerability. The EPSS score is not available, so the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV. The likely attack vector is through a crafted Redis command sent to a FalkorDB instance; an attacker with network or application access can send the vulnerable input. If successful, the module will crash, resulting in a denial of service that affects the entire FalkorDB service. No privilege escalation or data compromise is reported.