CVE-2026-5759: critical vulnerability in FalkorDB
Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
Published
25Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3
exploitation probability
—
observed exploitation
nono source reports it
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FalkorDB · FalkorDBRelated CVEs — FalkorDB
In the same product, most dangerous first.
CVE-2026-107911HIGHType confusion in FalkorDB GRAPH.QUERY via the --bolt argumentEPSS —CVE-2026-107910CRITICALAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingEPSS —CVE-2026-107909HIGHPre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload lengthEPSS —CVE-2026-107908CRITICALPre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET messageEPSS —CVE-2026-7826HIGHHeap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDBEPSS —CVE-2026-7827CRITICALStack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDBEPSS —