CVE-2026-111279highCWE-789

CVE-2026-111279: falha de alta gravidade em dragonflydb dragonfly

Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dragonfly

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dragonflydb · dragonfly
CVEs relacionadas — dragonflydb dragonfly

No mesmo produto, das mais perigosas para as menos.

CVE-2026-62357HIGHDragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds writeEPSS 0.5%CVE-2026-54341HIGHDragonfly: RESTORE operations may crash the serverEPSS 0.5%CVE-2025-52935CRITICALInteger Overflow or Wraparound vulnerability in dragonflydb/dragonflyEPSS 0.4%CVE-2026-47206LOWDragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializerEPSS 0.4%CVE-2026-104192CRITICALDragonflyDB stream RDB deserialization double-freeEPSS 0.3%