Priority HIGH 77
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER.
Vulnerabilities
8 records
Priority MEDIUM 43
Dragonfly is an in-memory data store built for modern application workloads.
TI-2026-44509 CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
Priority HIGH 77
Dragonfly is an in-memory data store built for modern application workloads.
Priority HIGH 72
Dragonfly is an in-memory data store built for modern application workloads.
TI-2026-34794 CVE-2026-47206
Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer
Priority MEDIUM 45
Dragonfly is an in-memory data store built for modern application workloads.
TI-2025-32963 CVE-2025-52935 · GHSA-c6x7-hwq8-gfmj
Integer Overflow or Wraparound vulnerability in dragonflydb/dragonfly
Priority MEDIUM 43
Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules).
TI-2025-19280 CVE-2025-26269 · GHSA-cqc2-rc24-647j
Integer underflow in dragonflydb Dragonfly
Priority MEDIUM 58
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
TI-2025-19279 CVE-2025-26268 · GHSA-w33v-rv28-x6m6
DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of…
Priority MEDIUM 62
DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command.