Critical
Security advisory
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-7827
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:14 UTC · Revision 1
Source evidence
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.
osv:CVE-2026-7827
Complete source record
{
"id": "c6d4fcb5fc653784193de21b0f9c43f76548a9bdf0e48a44ab35735cb35efcb4",
"url": "https://osv.dev/vulnerability/CVE-2026-7827",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-7827",
"summary": "A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.",
"evidence": "osv:CVE-2026-7827",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-7827",
"aliases": [
"CVE-2026-7827"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/falkordb/falkordb",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "319232f2bb19875a0796742225945412295d944a"
},
{
"fixed": "7d15431aadf37588fadc2578b90c3afb5e8daa94"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "4.18.4"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "7d15431aadf37588fadc2578b90c3afb5e8daa94"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "319232f2bb19875a0796742225945412295d944a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v4.18.4"
}
]
}
}
],
"versions": [
"v4.18.3",
"v4.18.2",
"v4.18.1",
"v4.18.0",
"v1.0.15",
"v1.2.2",
"v1.99.7",
"v1.99.6",
"v1.99.5",
"v1.99.4",
"v1.99.3",
"v1.99.2",
"v1.99.1",
"v1.99.0",
"v1.2.1",
"v1.2.0",
"v1.0.14",
"v1.0.13",
"v1.0.12",
"v1.0.11",
"v1.0.10",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0-rc9",
"v1.0.0",
"GA",
"v1.0.0-rc8",
"v1.0.0-rc7",
"v1.0.0-rc6",
"v1.0.0-rc5",
"v1.0.0-rc4",
"v1.0.0-rc3",
"v1.0.0-rc2",
"1.0.0-rc2",
"1.0.0-rc1",
"v1.0.0-preview1",
"v1.0.0-beta4",
"v1.0.0-beta3",
"v1.0.0-beta2",
"1.0.0-beta2",
"v1.0.0-beta1",
"1.0.0-beta1",
"v1.0.0-alpha1",
"1.0.0-alpha1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7827.json",
"vanir_signatures": [
{
"id": "CVE-2026-7827-024fa5bd",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-087d0662",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v18/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-12eae4ff",
"digest": {
"length": 1452,
"function_hash": "109859579193763463314010922484954329257"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_DecodeTensors"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-1310474c",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-1372d823",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"215212721095035661738524820298256936667",
"292748887906922997709047761250117050981"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v18/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-1501394a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192678192151752859939399385117103878216",
"270390829398979339685274696210945141218",
"12920727336730426810433304969973988617",
"242315355340246419597840721239173226291",
"201592989836393303364465878449486359827",
"2369546410841752116613544575533475883",
"227601016539468842553952017225376770889",
"274449411650993652266263681135630373548",
"245364090210802416780009153690296674055",
"43859370399839708415976380621448293556",
"172680512367336476979575865278855394383",
"295720862458584213403776538512417660201",
"272611213071459213093950119120525758798",
"316591920628458702265908677721318041571",
"265433891670753884417399714324847483705",
"304414989011077261516057241634721468412",
"90806875431358729905529136117523733901",
"217221421848454816742263664764347853389",
"199070384579132002707669780607445094126",
"236509720256657537030720431281529715730",
"135508912284604370742886887075429204534",
"142011932504225210729090633882165268331",
"152532427349155288999186612881128176647",
"37602640498691226708153146886300258548",
"332396324799206570874141332737874978754",
"161916654098594536594472873491498792372",
"212171432103949544479920955119375952840",
"235955324932835386897991667164931875433",
"292992252229748827718836247168007508345",
"59017704338814934955973155694349595561",
"80319345885091074197425072116521773897",
"201541717412904143452260414197344225132"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/serializer_io.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-2a8caf36",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v18/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-2c7b5390",
"digest": {
"length": 1058,
"function_hash": "47231701817865803598400779082765227954"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_DecodeEdges"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-2cdc26d9",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v14/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-2efab20c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"45398681430226411807714125760268008298",
"300719784447583775623402665371543946999"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v11/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-4a98bc41",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/current/v19/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-4e3cffe8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"83901757983073500786641527759754352817",
"1119039845501709018176210132053473052"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/current/v19/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-50353949",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v10/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-53c7ceb7",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v11/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-54b5b975",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"45398681430226411807714125760268008298",
"300719784447583775623402665371543946999"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v11/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-56f09429",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"215212721095035661738524820298256936667",
"292748887906922997709047761250117050981"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v18/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-5a4e8b6f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"128974211903470422142348545434600643619",
"22947575081305471747615212549459847795"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v13/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-5cd06208",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v13/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-5e123cfa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"154446342635534854908858518660729561576",
"98229661111661094734134438412356035478"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v12/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-5f201f19",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v17/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-615d377a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"154446342635534854908858518660729561576",
"98229661111661094734134438412356035478"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v12/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-64b29dca",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v15/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-66fb5566",
"digest": {
"length": 781,
"function_hash": "157456801595927529236389010417542601014"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "RdbLoadNodes_v16"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-6c40df6e",
"digest": {
"length": 914,
"function_hash": "210258637283126267096859146645698414317"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/serializer_io.c",
"function": "BufferSerializerIOv2_ReadBuffer"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-6fe9af5a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"74663144111778375960050561305661232830",
"85832594088999084652382507115425426378",
"210251498907881013570240578510655293963",
"67240452028131488707301009412536053911",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"14088463841615704871582483407930329002",
"332878198422621719691621862704679971231"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v14/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-781b3ada",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"103634129928168954908080174900903728296",
"29967146438987212831343939795781241078"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v17/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-7e4c17e1",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v12/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-81b7822a",
"digest": {
"length": 781,
"function_hash": "157456801595927529236389010417542601014"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "RdbLoadNodes_v16"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-8bf2ebad",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"252388631552206490353735786315550892444",
"42554507818644937910909556924188686835"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v10/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-8c2ded32",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v12/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-8ed0dc73",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v14/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-979c7be7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"321962516309770138952794452091719266572",
"33520064566463605498793731840782487011",
"110988516452510005317880894150210549495",
"122543055998087378223525692372587025086",
"328910879583169477335647815887261115793",
"254722597407683862238749649174975144518",
"1948579267395617297161336356421977562",
"114648478623564347866349978017971110912",
"207426801346880301477795571925500655958",
"69541474307087055319276963868547541348",
"336637746044763856538986170980815825858",
"114546237000278652299458110668451842264",
"207426801346880301477795571925500655958",
"69541474307087055319276963868547541348"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-a02d7568",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"74663144111778375960050561305661232830",
"85832594088999084652382507115425426378",
"210251498907881013570240578510655293963",
"67240452028131488707301009412536053911",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"14088463841615704871582483407930329002",
"332878198422621719691621862704679971231"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v14/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-a1522f6d",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/current/v19/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-a1e1891f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"74663144111778375960050561305661232830",
"85832594088999084652382507115425426378",
"210251498907881013570240578510655293963",
"67240452028131488707301009412536053911",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"309390934464232644044805282737648182031",
"23285632968992277132260056596753453609",
"279387967041653709149783022053711365526",
"155330745808484497272306605911483319387",
"103298886575340515448803105666787046418",
"302356410342865836180601183841281679929",
"202587535187847119079469781785580118025",
"185815458979629197266900991229936614657",
"184558103778865994047529640046851401049",
"63875437453321270273448368692275054534",
"170049201877619322630123006922644237672",
"223982854846218884449021518880089220178",
"326816410387634702044983381453677161831",
"207594715656556268234134167343030165088",
"122543055998087378223525692372587025086",
"132166225674097781318938026150215575655",
"249795995631391351489910477532875908945",
"317961837796831064846976623372342916137",
"157216347526864602014589125936432453024",
"157898439823175014129085221152787060137",
"273769098638311856006414567656778473583",
"247232324598475574101422989843392307347",
"2334939927996992722260010110813521932",
"180461853176214264465185742153994419225",
"26530473517283042042507601694137682407",
"296994310950277160986281396862051342827",
"149277937388867456317409859396965299174"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v15/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-af6a0952",
"digest": {
"length": 1452,
"function_hash": "109859579193763463314010922484954329257"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_DecodeTensors"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-b652d128",
"digest": {
"length": 333,
"function_hash": "271714945829181852027285128042991070165"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v17/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-b6b29b14",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"74663144111778375960050561305661232830",
"85832594088999084652382507115425426378",
"210251498907881013570240578510655293963",
"67240452028131488707301009412536053911",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"309390934464232644044805282737648182031",
"23285632968992277132260056596753453609",
"279387967041653709149783022053711365526",
"155330745808484497272306605911483319387",
"103298886575340515448803105666787046418",
"302356410342865836180601183841281679929",
"202587535187847119079469781785580118025",
"185815458979629197266900991229936614657",
"184558103778865994047529640046851401049",
"63875437453321270273448368692275054534",
"170049201877619322630123006922644237672",
"223982854846218884449021518880089220178",
"326816410387634702044983381453677161831",
"207594715656556268234134167343030165088",
"122543055998087378223525692372587025086",
"132166225674097781318938026150215575655",
"249795995631391351489910477532875908945",
"317961837796831064846976623372342916137",
"157216347526864602014589125936432453024",
"157898439823175014129085221152787060137",
"273769098638311856006414567656778473583",
"247232324598475574101422989843392307347",
"2334939927996992722260010110813521932",
"180461853176214264465185742153994419225",
"26530473517283042042507601694137682407",
"296994310950277160986281396862051342827",
"149277937388867456317409859396965299174"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v15/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-c6f05853",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"103634129928168954908080174900903728296",
"29967146438987212831343939795781241078"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v17/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-c966b907",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v11/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-d45436f5",
"digest": {
"length": 1058,
"function_hash": "47231701817865803598400779082765227954"
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c",
"function": "_DecodeEdges"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-d9d2cccd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69782546858709046733416743485151443054",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"180793109560682869963258925859274983808",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"83901757983073500786641527759754352817",
"1119039845501709018176210132053473052"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/current/v19/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-da3f477a",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v10/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-e2450fbf",
"digest": {
"length": 326,
"function_hash": "270878464494357730931961057762145414762"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v13/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-e58d4152",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"252388631552206490353735786315550892444",
"42554507818644937910909556924188686835"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v10/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-e757d335",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218913705069828192701386390435274877914",
"190066225126411862531182741268449665074",
"73624761064294119667396769784193975821",
"62957372483852055076474250480513679429",
"63124101076217722987395946525298461610",
"246732728581982824336127648271019098026",
"40806764566028160908105163356576502003",
"313176171922768538464403488885296341684",
"55896317253669709021279505740718910716",
"264281687005753557391350353239105901081",
"128664792730706041450153519333906488938",
"114403533569202092495700958694185305404",
"208930088130072594881776894503614717745",
"30655090663312623771894053951401785717",
"123516709492682511671068507350285054830",
"124701721992601309031743397164030739439",
"321962516309770138952794452091719266572",
"33520064566463605498793731840782487011",
"110988516452510005317880894150210549495",
"122543055998087378223525692372587025086",
"328910879583169477335647815887261115793",
"254722597407683862238749649174975144518",
"1948579267395617297161336356421977562",
"114648478623564347866349978017971110912",
"207426801346880301477795571925500655958",
"69541474307087055319276963868547541348",
"336637746044763856538986170980815825858",
"114546237000278652299458110668451842264",
"207426801346880301477795571925500655958",
"69541474307087055319276963868547541348"
]
},
"source": "https://github.com/falkordb/falkordb/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"target": {
"file": "src/serializers/decoders/prev/v16/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-f4c9642d",
"digest": {
"length": 349,
"function_hash": "206406948930103405570313861217155779090"
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v15/decode_graph_entities.c",
"function": "_RdbLoadEntity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-7827-f979c65f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100367786413815572001501438038295132468",
"268874998894792203935630657479381044216",
"202964171897110567941810762296774791624",
"172251351634505419993170222579292793946",
"66315596235929937785908389542118072463",
"283998196261973457848399772612424689799",
"290275820653197923215441308947434728769",
"73712777487039432506091427392059960002",
"204183113072755602454820747663913131496",
"253716877582876300629351902108860432120",
"20352396948089668487150989563854209443",
"282576928919821825902596441723896557447",
"213261889071014790486197506891364470070",
"252860056205101838014296015159145733678",
"124701721992601309031743397164030739439",
"128974211903470422142348545434600643619",
"22947575081305471747615212549459847795"
]
},
"source": "https://github.com/falkordb/falkordb/commit/319232f2bb19875a0796742225945412295d944a",
"target": {
"file": "src/serializers/decoders/prev/v13/decode_graph_entities.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T18:08:30Z"
}
}
],
"modified": "2026-10-20T18:08:30.930047326Z",
"provider": "osv",
"references": [
"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4",
"https://github.com/FalkorDB/FalkorDB/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94",
"https://github.com/FalkorDB/FalkorDB/pull/1973"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-7827",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 390132,
"published_at": "2026-10-09T05:16:45.327+00:00"
}