Dragonflydb Dragonfly
8 CVEs affecting Dragonflydb Dragonfly. Latest disclosed: 2026-10-15. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-104192 | Critical | 9.6 | 2026-10-13 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associa… |
CVE-2026-111279 | High | 7.5 | 2026-10-15 | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT… |
CVE-2026-54341 | High | 7.5 | 2026-06-26 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in Drago… |
CVE-2025-26269 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that re… |
CVE-2025-26268 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the sca… |
CVE-2026-62357 | | 2026-08-18 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width ti… | |
CVE-2026-47206 | | 2026-06-26 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply… | |
CVE-2025-52935 | | 2025-06-23 | Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_s… |