Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck
CVE-2026-111279Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
High 7.5
In plain English
A high-severity security flaw in dragonfly from dragonflydb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dragonflydb | dragonfly | 0 – through 2.0.2 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #8578 issue-tracking
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483 technical-description
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522 technical-description
- https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984 technical-description
- https://github.com/dragonflydb/dragonfly product
- VulnCheck Advisory: Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER third-party-advisory