CVE-2026-5759

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-415CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR17h
🚨Critical - FalkorDB Memory Corruption Issues (CVE-2026-5759 / CVE-2026-107908) FalkorDB has two critical memory corruption issues caused by ASSERT() checks that are compiled out in release builds. A crafted RDB stream triggers double free + use-after-free in RdbLoadDeletedNodes (CVE-2026-5759), and a Bolt RESET message with attacker-chosen chunk size causes heap OOB write in BoltReadHandler (CVE-2026-107908). Both allow remote unauthenticated DoS and potentially RCE. Deployments with Bolt disabled (BOLT_PORT unset, default) are not affected by the Bolt issue. 👉Affected: FalkorDB < 4.20.0 | Upgrade to 4.20.0
0000029
315 followersView on X

Explore more

Back to dashboard