Read the docs
TI-2026-39235 Aliases CVE-2026-54341

Dragonfly: RESTORE operations may crash the server

Priority HIGH 72CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command — a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed dragonfly (dragonflydb): 1.39.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dragonflydbdragonflybefore 1.39.01.39.0Patch availableCNA
  • dragonfly Vendordragonflydb Affected before 1.39.0 Fixed in 1.39.0 Patch available CNA

Remediation

  • Fix · CNA dragonfly (dragonflydb) Fixed in 1.39.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54341
  2. 2026-10-26 EPSS moved to the below the 50th percentile

References

Other 2

  • TI-2026-75060 Unbounded memory allocation in Dragonfly via negative COUNT values CVSS 4.0HIGH 8.7
  • TI-2026-44509 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write CVSS 4.0HIGH 8.8
  • TI-2025-19279 DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of… CVSS 3.1MEDIUM 6.5
  • TI-2025-19280 Integer underflow in dragonflydb Dragonfly CVSS 3.1MEDIUM 5.5
  • TI-2026-34794 Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer CVSS 4.0LOW 2.3
  • TI-2026-71838 Double free in DragonflyDB stream RDB deserialization CVSS 3.1CRITICAL 9.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences