Executive brief
Dragonfly is a high-performance in-memory data store used for modern application workloads. A vulnerability in how the system handles data restoration commands allows an unauthenticated remote attacker to crash the entire server process with a very small, specially crafted command. This results in a complete service outage and loss of availability for all connected applications and data shards.
Technical details
An out-of-bounds read vulnerability exists in DragonflyDB's listpack collection loaders (affecting SET, HASH, ZSET, LIST, and STREAM types). The root cause is the use of shallow integrity checks (lpValidateIntegrity with deep=0) during the RESTORE command, which validates the listpack header but ignores interior entry lengths. An attacker can provide a payload declaring a large entry length (e.g., 0x7fffffff) without providing the actual data; when the loader iterates the collection, it trusts this length, leading to a SIGSEGV. Since DragonflyDB requires no authentication by default and RESTORE is a standard keyspace command, this allows for a repeatable, unauthenticated denial of service. The issue is fixed in version 1.39.0 by implementing deep integrity validation for untrusted RESTORE inputs.
Affected products
- DragonflyDB Dragonfly < 1.39.0
Timeline
- 2026-06-03: patched: Fix merged in pull request #7502
- 2026-06-15: advisory: GitHub Security Advisory GHSA-cwjr-j869-h8q9 published
- 2026-06-26: disclosed: CVE-2026-54341 published to NVD