Read the docs
TI-2026-71838 Aliases CVE-2026-104192

Double free in DragonflyDB stream RDB deserialization

Priority MEDIUM 43CWE-415Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

Dragonfly before 1.40 contains a double free (CWE-415) in stream RDB loading. A crafted serialized stream sent to RESTORE makes the server free the same object twice. In the default configuration, where authentication is disabled, an unauthenticated remote attacker can corrupt allocator state, cause denial of service, and potentially execute code as the Dragonfly service account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed dragonfly (dragonflydb): 1.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dragonflydbdragonflybefore 1.401.40Patch availableCNA
  • dragonfly Vendordragonflydb Affected before 1.40 Fixed in 1.40 Patch available CNA

Remediation

The sources list no fixed version for Dragonfly.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA dragonfly (dragonflydb) Fixed in 1.40

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-104192

References

Other 3

  • TI-2026-75060 Unbounded memory allocation in Dragonfly via negative COUNT values CVSS 4.0HIGH 8.7
  • TI-2026-44509 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write CVSS 4.0HIGH 8.8
  • TI-2026-39235 Dragonfly: RESTORE operations may crash the server CVSS 3.1HIGH 7.5
  • TI-2025-19279 DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of… CVSS 3.1MEDIUM 6.5
  • TI-2025-19280 Integer underflow in dragonflydb Dragonfly CVSS 3.1MEDIUM 5.5
  • TI-2026-34794 Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer CVSS 4.0LOW 2.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences