Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104192: DragonflyDB lets unauthenticated users crash or hijack service

CVE-2026-104192 · published 3 days ago

Summary

The in‑memory database DragonflyDB (versions before 1.40) can be tricked into freeing the same memory area twice. An attacker without a login can send a specially crafted data stream, causing the program to stop working or run malicious code under the service’s rights. Apply the vendor’s patch as soon as it is released or upgrade to a version that includes the fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dragonflydb	dragonfly	< 1.40

Original advisory text

DragonflyDB stream RDB deserialization double-free

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

References

https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f070... Patch
https://github.com/dragonflydb/dragonfly/pull/7929 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1041... Vendor Advisory
https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104192 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-415Double Free

Timeline

Published13 Oct 2026

Updated15 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-104192 · NVD

CVE-2026-104192 · MITRE

CVE-2026-104192 · OSV

GHSA-cg35-6jf4-crfh · GHSA

Track software like this

Free during beta