Is CVE-2026-104192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104192 being exploited in the wild.

How severe is CVE-2026-104192?

Critical severity, with a CVSS score of 9.6, published 13 October 2026.

Which products and versions are affected?

DragonflyDB Dragonfly before 1.40.

Is there a fix for CVE-2026-104192?

A patch was published on 2026-07-24: Fix merged in commit 6c6b27a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104192 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104192?

Check whether you run DragonflyDB Dragonfly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104192: Dragonfly double-free in RDB stream consumer group loading

CVE-2026-104192 · Severity: critical · CVSS 9.6 · Published 2026-10-13

Dragonfly is an in-memory database that stores data for modern applications. A flaw in how it loads serialized stream data allows an unauthenticated attacker to trigger a double-free memory error by sending a crafted RESTORE command, which can crash the service or potentially execute arbitrary code with the Dragonfly process's privileges.

Technologies: DragonflyDB Dragonfly. Vendors: DragonflyDB.

Quick answers

Is CVE-2026-104192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104192 being exploited in the wild.
How severe is CVE-2026-104192?: Critical severity, with a CVSS score of 9.6, published 13 October 2026.
Which products and versions are affected?: DragonflyDB Dragonfly before 1.40.
Is there a fix for CVE-2026-104192?: A patch was published on 2026-07-24: Fix merged in commit 6c6b27a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104192 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104192?: Check whether you run DragonflyDB Dragonfly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in OpaqueObjLoader::CreateStream in rdb_load.cc, where duplicate consumer entries in a stream consumer group can cause one streamNACK object to be referenced in both a global PEL and consumer-local PEL, then freed twice when the duplicate is rejected. An unauthenticated network attacker can exploit this pre-authentication via a crafted serialized stream sent to the RESTORE command, achieving allocator corruption, denial of service, or code execution.

Affected products

DragonflyDB Dragonfly before 1.40

Timeline

2026-10-13: disclosed
2026-07-24: patched: Fix merged in commit 6c6b27a

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.