CVE Intelligence
Analysis AI-assisted

CVE-2026-104192: DragonflyDB stream RDB deserialization double-free

Dragonfly versions before 1.40 contain a double-free (CWE-415) in the RDB stream loading logic, reachable through the RESTORE command. The record reports a GitHub CVSS 3.1 score of 9.6 and says that, with default settings, an unauthenticated client could potentially trigger it. No fixed release is mapped in the record, so operators should restrict access and monitor until a confirmed fix is available.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Dragonfly is an in-memory data store. CVE-2026-104192 describes a double-free (CWE-415) in the handling of serialized stream data during RDB loading, reachable through the RESTORE command in versions before 1.40. The GitHub advisory is GHSA-cg35-6jf4-crfh.

Impact

  • According to the record, successful triggering could cause allocator corruption, denial of service and, potentially, code execution as the Dragonfly service account.
  • The GitHub CVSS 3.1 vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a score of 9.6 and severity critical.
  • The record states that authentication is disabled in the default configuration, which is why no privileges are required under this vector.

Affected products and versions

  • Dragonflydb Dragonfly: versions below 1.40.
  • The record lists no fixed version. The source fix is described as not yet mapped to a published release.

Exploitation status

CISA KEV does not list this CVE, and the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted. The record marks the issue as not automatable in SSVC terms.

Remediation and mitigation

  • Check the GitHub advisory and the related pull request for updates on a released fix, and upgrade as soon as a fixed version is confirmed.
  • Enable authentication, since the record says it is disabled by default.
  • Limit network exposure so that only trusted clients and networks can reach Dragonfly instances.
  • Review which services and users can send RESTORE commands and restrict them where possible.

Detection guidance

  • Monitor for RESTORE traffic from unexpected sources, especially from clients that are not authenticated.
  • Watch for unexpected crashes, restarts or memory allocator errors in Dragonfly logs.
  • Correlate service instability with recent client connections to identify possible abuse.

Limitations of the available information

  • No fixed version is mapped in the record, and the fix commit is listed without a confirmed release.
  • The EPSS score is missing, so the likelihood of exploitation is unknown.
  • The record does not describe the affected code paths beyond the function named in the description, nor any observed attacks.

Frequently asked questions

Which Dragonfly versions are affected by CVE-2026-104192?

The record lists Dragonflydb Dragonfly versions below 1.40 as affected.

Is there a fixed version available?

The record does not list a fixed version and states that the source fix has not yet been mapped to a published release. Check the GitHub advisory for updates.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.