CVE-2026-104192
CriticalCVSS 9.6Summary
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account.
Risk Assessment
An unauthenticated attacker can cause denial of service and potentially remote code execution in the context of the Dragonfly service account. This leads to loss of availability and potential full system compromise.
Recommendation
Upgrade Dragonfly to version 1.40 or later as soon as available. In the meantime, enable authentication and restrict network access to the Dragonfly instance.
Other vulnerabilities in Dragonfly
See all- CVE-2026-54637Medium
In Dragonfly prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult. These values are copied into resource.Host, and Peer.DownloadTinyFile() builds an HTTP GET request without destination validation, allowing read SSRF against loopback, link-local, and private services. DownPort is restricted to 1024-65534, and up to 128 bytes of the response can be placed in Task.DirectPiece.
- CVE-2026-49254Low
Dragonfly prior to 2.4.4 registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while the handler returns models.Oauth records with client_secret exposed in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can retrieve the provider's client secret, client identifier, and redirect URL.
- CVE-2026-62357High
Dragonfly before version 1.40.0 has a vulnerability in CMS.INITBYDIM and CMS.INITBYPROW commands where an arithmetic overflow in buffer size calculation leads to undersized buffer allocation. This allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server.
Original NVD description (English source)
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS