A stack overflow occurs in the _GetGroup() function of FalkorDB’s Redis module (ops/op_aggregate.c). When a crafted input is processed, the overflow corrupts the stack and crashes the module, resulting in service unavailability. The available information does not explicitly state that the flaw enables code execution or data disclosure, and that inference is therefore not confirmed; however, it can bring the entire Redis instance to a halt if the module is active.

FalkorDB Redis module versions 4.20.1 through 4.20.4 are affected. The vulnerability exists within the module itself; any deployment that loads these versions into a Redis server is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is less than 1% and the issue is not listed in CISA KEV, suggesting no documented public exploitation at this time. The most likely attack path involves a Redis client that can send commands to the module; a remote attacker with network access to the Redis instance could trigger the DoS by sending a malicious _GetGroup() request. Authentication is not required if the attacker can reach the instance, and no special conditions are noted.