Threat database

DragonflyDB versions up to 2.0.2 have a vulnerability where unauthenticated clients can cause unbounded memory allocation by passing a negative COUNT parameter to certain commands (HRANDFIELD, ZRANDMEMBER, SRANDMEMBER). This can lead to memory exhaustion and trigger the operating system's out-of-memory (OOM) killer, terminating the Dragonfly instance and disrupting service for all clients.

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

CVE-2026-62357 is an integer overflow vulnerability in dragonflydb's dragonfly prior to version 1.40.0. The flaw occurs in CMS.INITBYDIM and CMS.INITBYPROB functions, where dimensions can overflow when calculating buffer size, leading to undersized allocation. This allows an unauthenticated remote attacker to corrupt or disclose adjacent heap memory and potentially crash the server. The issue is fixed in version 1.40.0.

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command — a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0.

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.

Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C. This issue affects dragonfly: 1.30.1, 1.30.0, 1.28.18.