DragonflyDB - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/dragonflydb/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 22:49:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnbounded Memory Allocation in DragonflyDBhttps://feed.craftedsignal.io/briefs/2026-10-dragonfly-memory-exhaustion/Thu, 15 Oct 2026 22:49:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-dragonfly-memory-exhaustion/An unauthenticated denial-of-service vulnerability in DragonflyDB allows remote attackers to cause instance termination via unbounded memory allocation.DragonflyDB versions 2.0.2 and earlier contain an unbounded memory allocation vulnerability identified as CVE-2026-111279. The flaw exists in the handling of the COUNT argument within the HRANDFIELD, ZRANDMEMBER, and SRANDMEMBER commands. An unauthenticated attacker can exploit this by sending a specially crafted command featuring a large negative COUNT value against a key containing a single element. This triggers the server to allocate an excessive amount of memory, forcing the operating system to invoke the Out-of-Memory (OOM) killer. The resulting memory pressure leads to the termination of the Dragonfly instance, causing a complete denial-of-service for all connected clients. Given the ease of exploitation through a single command, this vulnerability presents a significant risk to the availability of affected deployments.

Impact

Successful exploitation of CVE-2026-111279 results in the immediate termination of the DragonflyDB instance. This causes a denial-of-service condition, disrupting all services dependent on the database. Because the attack only requires a single command to a key with at least one element, the barrier to exploitation is low for any network-reachable instance.

Recommendation

  • Upgrade all instances of DragonflyDB to a version beyond 2.0.2 that addresses the memory allocation flaw.
  • Restrict network access to DragonflyDB instances to authorized clients only, preventing unauthenticated access to the service.
]]>highadvisorydenial-of-servicevulnerabilitydragonflydb