Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Published: 2026-10-13
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Dragonfly is vulnerable to a double‑free bug that occurs while deserializing stream data during the RDB restore process. The OpaqueObjLoader::CreateStream routine in src/server/rdb_load.cc can inadvertently free the same streamNACK object twice when a duplicate consumer entry is rejected, leading to allocator corruption. Consequence of the corruption is a denial of service and, under the right conditions, attacker‑controlled code execution as the Dragonfly service account.

Affected Systems

DragonflyDB Dragonfly, versions earlier than 1.40 are affected. No published release includes the fix at this time.

Risk and Exploitability

The CVSS score of 9.6 indicates a critical severity. EPSS is not provided, and the vulnerability is not listed in CISA KEV. The attack vector is likely a remote unauthenticated client exploiting the default configuration in which authentication is disabled; such a client can send a crafted serialized stream to the RESTORE command to trigger the double‑free. If a successful exploitation occurs, it can lead to memory corruption and arbitrary code execution within the service process.

Generated by OpenCVE AI on October 13, 2026 at 16:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Dragonfly to version 1.40 or later when the patch becomes available.
  • Enable authentication or otherwise restrict the RESTORE command so only trusted authenticated users can invoke it.
  • If upgrading is not immediately possible, isolate the Dragonfly instance behind a firewall or network segment and monitor for crashes or abnormal memory usage.

Generated by OpenCVE AI on October 13, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Dragonflydb
Dragonflydb dragonfly
Vendors & Products Dragonflydb
Dragonflydb dragonfly

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Title DragonflyDB stream RDB deserialization double-free
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Dragonflydb Dragonfly
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T15:26:00.663Z

Reserved: 2026-10-01T18:54:15.119Z

Link: CVE-2026-104192

cve-icon Vulnrichment

Updated: 2026-10-13T15:25:56.379Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T15:17:31.087

Modified: 2026-10-13T16:17:11.333

Link: CVE-2026-104192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T16:45:19Z

Weaknesses