FalkorDB Fixes Critical Double Free Vulnerability in Graph Decoder

FalkorDB has released version 4.18.1 to address a critical security vulnerability that allows remote attackers to execute arbitrary code or cause denial of service conditions. The flaw, tracked as CVE-2026-5759, resides in the RDB graph decoders and affects all versions of the graph database engine prior to 4.18.1.

The vulnerability stems from improper memory handling within the `RdbLoadDeletedNodes` function, located in the source files `src/serializers/decoders/*/decode_graph_entities.c`. According to the National Vulnerability Database (NVD), the issue is classified as Critical with a CVSS v3.1 score of 9.3. The technical weakness involves both CWE-415 (Double Free) and CWE-416 (Use After Free). An attacker can exploit this by supplying a crafted RDB stream that triggers a buffer length mismatch. Specifically, the exploit requires the deleted-nodes buffer length to not be a multiple of `sizeof(NodeID)`.

Technical Context and Exploitation

The exploitation vector relies on the ability to issue Redis replication commands against the target instance. This condition is typically met if the FalkorDB instance is configured without a password or if the attacker has already obtained valid credentials. The root cause of the vulnerability lies in the length check mechanism used by the `RdbLoadDeletedNodes` function.

The function relies on an `ASSERT()` macro to validate buffer lengths. In release builds of FalkorDB, this assertion is compiled out, meaning the check does not perform any validation. Consequently, the function proceeds to free the buffer, read from it, and then free it a second time. This sequence results in a double free condition, which can be leveraged by an attacker to corrupt memory structures. The outcome of such an attack is either a denial of service, crashing the `redis-server` process, or the execution of arbitrary code with the privileges of the service account.

Affected Systems and Scope

Only FalkorDB installations running versions prior to 4.18.1 are affected by CVE-2026-5759. The vulnerability is specific to the graph decoding components of the database. Organizations that have already upgraded to version 4.18.1 are not susceptible to this specific exploit. The risk is highest for instances exposed to untrusted networks or those lacking authentication mechanisms, as the attacker must be able to send replication commands to trigger the payload.

What should you do?

Administrators should immediately verify their current FalkorDB version. If the installation is older than 4.18.1, they should upgrade to the patched version as soon as possible. Until an update is applied, restrict network access to the Redis replication port and ensure that strong authentication is enabled to prevent unauthorized command execution. Monitor server logs for unusual replication traffic or process crashes that may indicate an exploitation attempt.