CVE-2026-5759 Details
Description
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
A double free and use-after-free vulnerability has been identified in the RDB graph decoders of FalkorDB, prior to version 4.18.1. The issue arises in the RdbLoadDeletedNodes function, where a remote attacker capable of issuing Redis replication commands can exploit a crafted RDB stream. The vulnerability allows for a denial-of-service condition or the execution of arbitrary code within the redis-server process. The problem stems from the deleted-nodes buffer length not being a multiple of the size of NodeID, leading to improper buffer handling. This vulnerability is particularly concerning for instances without a password configured.
Users can upgrade to FalkorDB version 4.18.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FalkorDB/FalkorDB/commit/523d98ac7ffe99f11a9c95c258025c235f0dff4c | securin | Source CodeVendor |
| https://github.com/FalkorDB/FalkorDB/pull/1843 | securin | Issue TrackingVendor |
| https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.1 | securin | Release NotesVendor |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| FalkorDB | < 4.18.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | securin |