CVE-2026-5759
CVE-2026-5759
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
Vulnerability class: Double Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c (patch)
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c (patch)
- 33c584b5-0579-4c06-b2a0-8d8329fcab9c (release-notes)
Frequently asked questions
- What is CVE-2026-5759?
- CVE-2026-5759 is a critical-severity vulnerability, classified under Double Free. CVSS score: 9.8/10. Published 2026-10-09.
- How severe is CVE-2026-5759?
- Critical severity. CVSS v3 base score is 9.8 out of 10.