This vulnerability allows an authenticated Dragonfly user to inject arbitrary RESP messages into a connection’s response stream via a Lua function in the EvalSerializer. The injection can desynchronize the client, causing erroneous replies or stale data for connection-pool clients. The impact is limited to disrupting communication and destabilizing application logic, and does not provide remote code execution or data exfiltration. The weakness appears as a CWE‑116 related bug involving improper encoding.

The weakness applies to DragonflyDB Dragonfly versions older than 1.39.9. All installations of the Dragonfly in-memory data store that use the affected Lua‑based EvalSerializer are at risk.

The CVSS score for this vulnerability is 2.3, indicating low severity. EPSS is not available and the issue has not been listed in CISA’s KEV catalog, further suggesting a modest likelihood of exploitation in the wild. The exploit requires authentication with a user that has permission to run Lua scripts. Because the flaw only causes desynchronization rather than privilege escalation, the overall risk to the system is considered low and mitigable by applying the available patch.