CVE-2026-5759

9.8 CRITICALpublic exploit available

Published 2026-10-09 · Updated 2026-10-13

AI risk analysis

Summary: This vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code by exploiting a double free and use-after-free flaw in the RdbLoadDeletedNodes function of FalkorDB before 4.18.1.
Exploitability: Exploitation requires the ability to issue Redis replication commands, which can be difficult if the server is properly secured with a password.
Blast radius: If exploited, this could lead to a complete denial of service or execution of arbitrary code on the redis-server process.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to FalkorDB 4.18.1 or later.

rcedosredis

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-415, CWE-416

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.