Unbounded memory allocation in Dragonfly via negative COUNT values
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-789.
Summary
The hash, sorted set and set random-element commands in Dragonfly through 2.0.2 allocate memory without a size limit (CWE-789). An unauthenticated remote attacker can exhaust memory with a single command that passes a huge negative count. The out-of-memory killer then terminates the instance, which disconnects all clients. CISA SSVC rates exploitation as proof of concept.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dragonflydb | dragonfly | up to 2.0.2 | — | No fix listed | CNA |
- dragonfly Vendordragonflydb Affected up to 2.0.2 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Dragonfly.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111279
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-18 CISA SSVC decision points changed
- 2026-10-18 Priority changed: LOW → HIGH
References
Other 5
- GitHub Issue #8578
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984
- https://github.com/dragonflydb/dragonfly
More dragonflydb vulnerabilities
- TI-2026-44509 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write CVSS 4.0HIGH 8.8
- TI-2026-39235 Dragonfly: RESTORE operations may crash the server CVSS 3.1HIGH 7.5
- TI-2025-19279 DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of… CVSS 3.1MEDIUM 6.5
- TI-2025-19280 Integer underflow in dragonflydb Dragonfly CVSS 3.1MEDIUM 5.5
- TI-2026-34794 Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer CVSS 4.0LOW 2.3
- TI-2026-71838 Double free in DragonflyDB stream RDB deserialization CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences