The vulnerability allows an unauthenticated client to request a negative COUNT value for the HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER commands. The server blindly interprets the negative argument as a request for a quantity of elements, resulting in an allocation that grows without bound. The oversized allocation triggers the operating system’s OOM killer, terminating the Dragonfly process and disconnecting all connected clients, thereby causing a forced denial of service.

The flaw is present in DragonflyDB version 2.0.2 and all newer versions up to that point. The issue resides in the set, sorted set, and hyperloglog command families and does not require any user authentication, so any host that can reach the Dragonfly port may supply the malignant command.

The CVSS score of 8.7 reflects the high severity of the denial of service impact, while the EPSS score of less than 1% indicates a very low observed exploitation probability. Because the flaw is not listed in the CISA KEV catalog, there is no evidence of active exploitation, yet a single malicious command can trigger the crash. The most likely attack vector is a network connection to the Dragonfly server using its client protocol; no elevated privileges or additional software are required.