CVE-2026-104192 Details
Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
A double-free vulnerability has been identified in DragonflyDB versions prior to 1.40, specifically within the OpaqueObjLoader::CreateStream function in the RDB loading process. This vulnerability arises when the stream deserialization process for consumer groups improperly manages the ownership of pending entry (NACK) structures. In the default configuration, where authentication is disabled, an unauthenticated client can exploit this vulnerability by sending a crafted serialized stream to the RESTORE command. This exploitation causes allocator corruption, leading to a denial-of-service condition and potentially allowing for remote code execution as the Dragonfly service account.
Users can update to DragonflyDB version 1.40 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e | [email protected] | Source CodeVendor |
| https://github.com/dragonflydb/dragonfly/pull/7929 | [email protected] | Source CodeVendor |
| https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dragonfly | < 1.40 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |