CVE-2026-54341 Details
Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command — a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0.
A denial-of-service vulnerability has been identified in DragonflyDB versions prior to 1.39.0. The issue arises when a crafted RESTORE command is processed, triggering an out-of-bounds read in the database's listpack collection loaders. This flaw causes the server to crash, terminating the entire process due to a segmentation fault (SIGSEGV). The vulnerability is particularly concerning because DragonflyDB does not require authentication by default, allowing an unauthenticated remote attacker to disrupt the server with a single, approximately 24-byte command. The problem is exacerbated by the fact that there are no operator-side mitigations available.
Upgrade to DragonflyDB version 1.39.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dragonflydb/dragonfly/pull/7502 | [email protected] | Source CodeVendor |
| https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DragonflyDB | <= df-v1.38.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |