CVE-2026-111279
CVE-2026-111279 · Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
CVSS 8.7 · High · EPSS 0.6%
- Published
- Updated
Affected products and versions
dragonfly
- Versions
- ≥ 0, ≤ 2.0.2: Affected (semver)
No fix published
Original sources
- https://github.com/dragonflydb/dragonfly/issues/8578
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984
- https://github.com/dragonflydb/dragonfly
- https://www.vulncheck.com/advisories/dragonfly-through-2.0.2-unbounded-memory-allocation-via-negative-count-in-hrandfield-zrandmember-and-srandmember
- https://nvd.nist.gov/vuln/detail/CVE-2026-111279