CVE-2026-5759: FalkorDB Use-After-Free Vulnerability

CVE-2026-5759 Overview

CVE-2026-5759 is a double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the FalkorDB RDB graph decoders located in src/serializers/decoders/*/decode_graph_entities.c. The flaw affects FalkorDB versions before 4.18.1. A remote attacker who can issue Redis replication commands against a vulnerable instance (for example, one with no password configured) can trigger the condition by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer and both reads and frees it again. Exploitation can cause denial of service or arbitrary code execution in the redis-server process.

Critical Impact
Unauthenticated remote attackers reaching the Redis replication interface can crash FalkorDB or execute arbitrary code in the redis-server process via a malformed RDB stream.

Affected Products

FalkorDB versions prior to 4.18.1
RDB graph decoders in src/serializers/decoders/current/v19/decode_graph_entities.c
RDB graph decoders in src/serializers/decoders/prev/v17/decode_graph_entities.c

Discovery Timeline

2026-10-09 - CVE-2026-5759 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-5759

Vulnerability Analysis

The vulnerability resides in RdbLoadDeletedNodes, which reads a buffer of deleted node identifiers from an RDB stream using SerializerIO_ReadBuffer. The code validates buffer alignment with ASSERT(), expecting the returned length n to be a multiple of sizeof(NodeID). In release builds, ASSERT() expands to a no-op, so the alignment guard never halts execution. When an attacker supplies a crafted RDB payload with a misaligned buffer, the function frees deleted_nodes_list inside the failed-assertion branch, then falls through and iterates over the already-freed memory before freeing it a second time. This produces both a use-after-free [CWE-416] during the read loop and a double free [CWE-415] when the buffer is released again.

Root Cause

The root cause is a missing return statement after a defensive rm_free call that was gated only by a debug-only ASSERT(). Because release builds strip the assertion, control flow continues past the free into code that dereferences the freed pointer. The subsequent cleanup path then frees the buffer again, corrupting allocator metadata.

Attack Vector

An unauthenticated attacker with network access to a FalkorDB instance that accepts Redis replication commands can issue a REPLICAOF/SLAVEOF or related replication flow and deliver a malformed RDB stream. The crafted stream sets the deleted-nodes buffer size to a value that is not a multiple of sizeof(NodeID), triggering the double free and use-after-free inside the redis-server process address space.

// Patch: src/serializers/decoders/current/v19/decode_graph_entities.c
	size_t n;
	NodeID *deleted_nodes_list = (NodeID*)SerializerIO_ReadBuffer(rdb, &n);

-	// validate buffer alignment
-	if (n % sizeof(NodeID) != 0) {
-		rm_free (deleted_nodes_list) ;
-		ASSERT (false && "corrupted deleted nodes buffer") ;
+	// validate buffer: must be aligned and match expected count
+	if (n % sizeof(NodeID) != 0 ||
+		n / sizeof(NodeID) != deleted_node_count) {
+		rm_free(deleted_nodes_list);
+		RedisModule_Log(NULL, "warning",
+			"Malformed RDB: deleted nodes buffer size %zu "
+			"is not aligned or does not match expected count %" PRIu64,
+			n, deleted_node_count);
+		RedisModule_Assert(false);
	}

-	ASSERT((n / sizeof(NodeID)) == deleted_node_count);
-
	// mark each node id as deleted
	for(uint64_t i = 0; i < deleted_node_count; i++) {
		NodeID id = deleted_nodes_list[i];

Source: FalkorDB commit 523d98a

The patch replaces the debug-only ASSERT() with RedisModule_Assert(), which aborts in release builds, and adds structured logging plus an explicit count check so the function cannot continue after freeing the buffer.

Detection Methods for CVE-2026-5759

Indicators of Compromise

Unexpected redis-server process crashes or restarts coinciding with inbound replication traffic
Allocator diagnostics (glibc double free or corruption, jemalloc abort messages) in FalkorDB logs
Replication handshake events from untrusted source IPs targeting unauthenticated FalkorDB instances

Detection Strategies

Inventory FalkorDB deployments and flag any instance running a version earlier than 4.18.1
Audit Redis configuration for missing requirepass or absent bind restrictions that expose the replication interface
Inspect network telemetry for REPLICAOF/SLAVEOF commands originating outside expected replication peers

Monitoring Recommendations

Enable crash and core-dump collection for redis-server and alert on abnormal exit codes
Centralize FalkorDB module logs and alert on Malformed RDB warnings emitted by the patched decoder
Monitor memory-safety signals from AddressSanitizer or runtime allocators in pre-production environments

How to Mitigate CVE-2026-5759

Immediate Actions Required

Upgrade FalkorDB to version 4.18.1 or later on all affected hosts
Configure requirepass and strong authentication on every Redis instance running the FalkorDB module
Restrict network exposure of the Redis replication port to trusted replication peers only

Patch Information

The fix is published in FalkorDB Release v4.18.1 and merged via GitHub Pull Request #1843. The code change is available in FalkorDB commit 523d98a, which replaces the debug-only ASSERT() with RedisModule_Assert() and adds a count-matching validation check in both the current (v19) and previous (v17) decoders.

Workarounds

Enforce authentication by setting requirepass and disabling default accounts on every FalkorDB node
Bind the service to loopback or a private management interface and block replication ports at the firewall
Disable or rename the replication commands using Redis rename-command REPLICAOF "" where replication is not required

bash

# redis.conf hardening for FalkorDB instances pending upgrade
requirepass <strong-random-password>
bind 127.0.0.1 10.0.0.10
protected-mode yes
rename-command REPLICAOF ""
rename-command SLAVEOF ""