Description
An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Published: 2026-09-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An integer overflow in the _BulkInsert_ReadProperty component of FalkorDB, a Redis module, is triggered by a crafted bulk insert command that causes the module to crash. The vulnerability does not enable code execution or data disclosure; its effect is a denial of service that renders the database or application unavailable to legitimate users.

Affected Systems

FalkorDB, Redis module version 4.20.1, is the only product affected according to the current information. No other vendor or product versions are reported as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that attackers would typically need network access to the Redis server and the ability to issue bulk insert commands, which often requires authentication or privileged access. Once the exploit is deployed, the affected instance will crash, causing a denial of service.

Generated by OpenCVE AI on September 26, 2026 at 07:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest FalkorDB release that contains the integer overflow fix.
  • If a patch is not yet available, disable or restrict the BulkInsert command for untrusted or unauthenticated users.
  • Implement monitoring to detect abrupt crashes of the FalkorDB module and automatically restart the Redis server.
  • Optionally, constrain the size or rate of bulk insert operations to reduce the likelihood of triggering the overflow.

Generated by OpenCVE AI on September 26, 2026 at 07:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Falkordb
Falkordb falkordb
Vendors & Products Falkordb
Falkordb falkordb

Sat, 26 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Title Integer Overflow in FalkorDB BulkInsert Component Causes DoS

Thu, 24 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 21 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N'}


Subscriptions

Falkordb Falkordb
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-24T20:10:01.426Z

Reserved: 2026-09-10T00:00:00.000Z

Link: CVE-2026-88412

cve-icon Vulnrichment

Updated: 2026-09-24T20:09:54.441Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T21:17:15.513

Modified: 2026-09-24T21:18:57.517

Link: CVE-2026-88412

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:48:10Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound