External risk intelligence

FalkorDB RDB Decoder Double Free and Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-5759

FalkorDB is typically deployed as a backend database component intended to run within internal networks. While it interacts with Redis replication commands, these services are not designed to be directly exposed to the public internet and are generally protected by internal network controls and authentication, making public internet reachability uncommon in standard deployment patterns.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in FalkorDB's RDB graph decoders could allow an attacker to cause a denial of service or execute arbitrary code. This is due to how the system handles deleted nodes, where a length check can be bypassed in release builds, leading to a double-free and use-after-free condition. The main concern is confirming relevance and exposure.

Double free vulnerability in database decoding.
Affects data integrity and server process availability.
Confirm if FalkorDB is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted RDB stream to a FalkorDB instance that is not password-protected and uses Redis replication. This crafted stream targets the RDB graph decoders, specifically the `RdbLoadDeletedNodes` function. By providing a deleted-nodes buffer length that is not a multiple of the expected size, the attacker can trigger a double free and use-after-free condition. This faulty memory handling, which bypasses release build assertions, can lead to a denial of service or allow for arbitrary code execution within the FalkorDB server process.

Entry condition: Network access to an unprotected FalkorDB instance.
Trigger point: Supplying a crafted RDB stream.
Resulting risk: Denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could trigger a double free and use-after-free vulnerability in FalkorDB's RDB graph decoders. This may allow for denial of service or arbitrary code execution within the redis-server process when a crafted RDB stream is provided.

Server process memory and execution.
Via crafted RDB stream over replication.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FalkorDB database administrators and infrastructure teams are responsible for addressing this vulnerability. The initial step is to locate all instances of FalkorDB, determine their exposure and criticality, and identify the designated owner for each instance. Subsequently, a remediation plan should be developed based on the identified risks.

Identify FalkorDB deployments and owners.
Verify instance reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FalkorDB and how is it used?

FalkorDB is a high-performance graph database engine that operates as a module within the Redis ecosystem. It is primarily used for storing and querying complex, highly connected datasets, allowing developers to perform rapid graph traversals and analysis directly on top of familiar Redis infrastructure.

What does this CVE-2026-5759 vulnerability actually mean?

This vulnerability involves memory management flaws known as double free and use-after-free. It occurs when the software incorrectly handles memory used for deleted nodes. Because critical safety checks are removed in standard release builds, the system can end up processing invalid data, which may allow an attacker to crash the database or potentially run unauthorized commands on the server.

How can an attacker trigger this memory error?

An attacker must be able to send a specially crafted RDB stream to the target FalkorDB instance using Redis replication commands. The bug is specifically triggered when the length of the deleted-nodes buffer provided in the data stream does not align with the expected size requirements. Simply accessing the instance is not enough; the attacker must successfully transmit this malformed data structure to the decoder.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely for most because FalkorDB is typically intended to run as a backend component within internal, secured networks. Because these services are generally protected by authentication and internal firewalls rather than being exposed to the public internet, direct reachability for such an attack is uncommon in standard deployment patterns.

What should I do first to manage CVE-2026-5759?

Begin by creating a complete inventory of all FalkorDB instances in your environment and identifying who owns each deployment. Once you have a map of your infrastructure, verify whether these instances are password-protected and restricted from external network access. Prioritize reviewing the configuration of any instance that might be reachable beyond your immediate internal network boundaries.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.