{"schema":"threatline.record/2","record":{"id":"CVE-2026-5759","aliases":[],"summary":"Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB","details":"A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.","categories":["Unclassified"],"product":"FalkorDB","vendor":"FalkorDB","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-5759","source_modified_at":"2026-10-13T17:01:45.296Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"FalkorDB","vendor":"FalkorDB","versions":[{"version":"0","lessThan":"4.18.1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-5759","source_modified_at":"2026-10-13T17:01:45.296Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"FalkorDB","ecosystem":null},"version":"4.18.1","basis":"first unaffected version stated in the CVE record"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00554,"percentile":0.45506,"score_date":"2026-10-23"},"published_at":"2026-10-09T04:04:28.078Z","modified_at":"2026-10-13T17:01:45.296Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-5759","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T17:01:45.296Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-5759","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/FalkorDB/FalkorDB/pull/1843","tags":["patch"]},{"source":"CVE List","url":"https://github.com/FalkorDB/FalkorDB/commit/523d98ac7ffe99f11a9c95c258025c235f0dff4c","tags":["patch"]},{"source":"CVE List","url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.1","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-13T15:28:40.207197Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T17:01:45.296Z","content_hash":"031d36b0a24abf29f21f6276e524ac1f20589ff2d9d56a42b299da89a9fa60ff"}}