FalkorDB: Double free and use-after-free in RDB deserialization
Summary
FalkorDB, a graph database running as a Redis module, contains a double free and use-after-free flaw in the loading of deleted graph entities from RDB data. A remote attacker who can send Redis replication commands, for example to an instance without a password, can supply a crafted RDB stream to crash the redis-server process or possibly execute arbitrary code. The length check relies on an ASSERT that is removed from release builds, so the flaw is present in standard binaries.
Affected
- FalkorDB before 4.18.1
- Exact affected 4.x builds below 4.18.1 not fully verified by vendor sources beyond this range
- Unknown whether 6.x builds are affected
Fixed in
- Upgrade to FalkorDB 4.18.1 or later (fix in commit 523d98ac and PR #1843)
- Later 4.x releases: verify the release notes before relying on them
Workaround
- Require authentication (requirepass or ACLs)
- Restrict or rename the REPLICAOF and SLAVEOF commands for untrusted clients
- Do not expose the instance to untrusted networks
- No vendor workaround replaces the upgrade
Exploitation
- No confirmed in-the-wild exploitation found
- No public proof of concept found
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Remote code execution is plausible but not demonstrated
Our recommendation
- Inventory FalkorDB instances, including Docker and Kubernetes deployments and AI tooling
- Upgrade all instances below 4.18.1 to 4.18.1 or later; do not mix 4.x and 6.0 in one replica set
- Remove internet exposure of the Redis port and require authentication now
- Restrict replication commands to administrative clients
- Monitor logs for unexpected replication connections
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-5759 on OSV osv.dev
- FalkorDB fix commit 523d98ac github.com
- FalkorDB pull request 1843 github.com
- FalkorDB release v4.18.1 github.com
- VulDB CVE-2026-5759 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:52.
Original description (NVD)
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.