CVE-2026-104192: CWE-415: Double Free in dragonflydb dragonfly
Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
CVSS v3.1
Score 9.6critical
Affected software
dragonflydb
dragonfly
pkg:github/dragonflydb/dragonflyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DragonflyDB before version 1.40 contains a double-free vulnerability (CWE-415) in the OpaqueObjLoader::CreateStream function located in src/server/rdb_load.cc. The issue arises because a streamNACK object is associated with both a global and a consumer-local Pending Entries List (PEL), and when a duplicate consumer entry is rejected, the shared object is freed twice. This double-free can be triggered by an unauthenticated client sending a specially crafted serialized stream to the RESTORE command, causing memory allocator corruption. The impact includes denial of service and potential attacker-controlled code execution under the Dragonfly service account. No official patch or fixed release has been published yet.
Potential Impact
An unauthenticated attacker can exploit this vulnerability remotely to cause allocator corruption, resulting in denial of service or potentially executing arbitrary code with the privileges of the Dragonfly service account. This represents a critical security risk due to the possibility of full system compromise.
Mitigation Recommendations
No official patch or fix has been published yet for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, consider restricting access to the RESTORE command or limiting unauthenticated client interactions with the Dragonfly service to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-01T18:54:15.119Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ace44e52cdf04f65678226a
Added to database: 10/13/2026, 14:49:09 UTC
Last enriched: 10/13/2026, 15:03:34 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.