← Back to the live CVE advisory feed

CVE-2026-5759: FalkorDB

Severity

9.3 (CRITICAL)

Vendor

FALKORDB

Affected versions

0 through before 4.18.1

Fixed version

4.18.1

Patch status

Patched

Published

2026-10-09T05:16:44.920

Modified

2026-10-09T05:16:45.043

Why it matters

Critical vulnerability requiring immediate validation against your environment.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.

View the official NVD record for CVE-2026-5759

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.