CVE-2026-104192: falha crítica em dragonflydb dragonfly
DragonflyDB stream RDB deserialization double-free
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.3%
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
dragonflydb · dragonflyCVEs relacionadas — dragonflydb dragonfly
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111279HIGHDragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBEREPSS 0.6%CVE-2026-62357HIGHDragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds writeEPSS 0.5%CVE-2026-54341HIGHDragonfly: RESTORE operations may crash the serverEPSS 0.5%CVE-2025-52935CRITICALInteger Overflow or Wraparound vulnerability in dragonflydb/dragonflyEPSS 0.4%CVE-2026-47206LOWDragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializerEPSS 0.4%