CVE-2026-5759: Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders//decodegraphentities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FalkorDBto a version that resolves this vulnerability.Fixed in 4.18.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
FalkorDB versions before 4.18.1 are affected when an attacker can issue Redis replication commands. An instance with no password configured is given as an example of an exposed deployment.
What does an attacker need to exploit this issue?
The attacker needs the ability to issue Redis replication commands and supply a crafted RDB stream. The malicious stream uses a deleted-nodes buffer length that is not a multiple of sizeof(NodeID).
What is the remediation?
Upgrade FalkorDB to version 4.18.1 or later. The vulnerability affects versions before 4.18.1.
What can be done if upgrading is not immediately possible?
Restrict access so untrusted parties cannot issue Redis replication commands. In particular, avoid unauthenticated instances and prevent attackers from providing RDB replication streams.