CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account.

In Dragonfly prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult. These values are copied into resource.Host, and Peer.DownloadTinyFile() builds an HTTP GET request without destination validation, allowing read SSRF against loopback, link-local, and private services. DownPort is restricted to 1024-65534, and up to 128 bytes of the response can be placed in Task.DirectPiece.

Dragonfly prior to 2.4.4 registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while the handler returns models.Oauth records with client_secret exposed in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can retrieve the provider's client secret, client identifier, and redirect URL.