CVE-2026-5759

Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.18.1

Description A double free and use-after-free issue exists in the RdbLoadDeletedNodes() function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger a denial of service or execute arbitrary code within the redis-server process. This occurs when a crafted RDB stream is provided where the deleted-nodes buffer length is not a multiple of sizeof(NodeID). Because the length check utilizes ASSERT(), which is removed during release builds, the system proceeds to free the buffer, read it, and then free it again.

Recommendations Update to version 4.18.1 or later.