Quick answers
- Is CVE-2026-54341 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54341 being exploited in the wild.
- How severe is CVE-2026-54341?
- High severity, with a CVSS score of 7.5, published 26 June 2026.
- Which products and versions are affected?
- DragonflyDB Dragonfly < 1.39.0.
- Is there a fix for CVE-2026-54341?
- A patch was published on 2026-06-03: Fix merged in pull request #7502 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54341 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-54341?
- Check whether you run DragonflyDB Dragonfly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability exists in DragonflyDB's listpack collection loaders (affecting SET, HASH, ZSET, LIST, and STREAM types). The root cause is the use of shallow integrity checks (lpValidateIntegrity with deep=0) during the RESTORE command, which validates the listpack header but ignores interior entry lengths. An attacker can provide a payload declaring a large entry length (e.g., 0x7fffffff) without providing the actual data; when the loader iterates the collection, it trusts this length, leading to a SIGSEGV. Since DragonflyDB requires no authentication by default and RESTORE is a standard keyspace command, this allows for a repeatable, unauthenticated denial of service. The issue is fixed in version 1.39.0 by implementing deep integrity validation for untrusted RESTORE inputs.
Affected products
- DragonflyDB Dragonfly < 1.39.0
Timeline
- 2026-06-03: patched: Fix merged in pull request #7502
- 2026-06-15: advisory: GitHub Security Advisory GHSA-cwjr-j869-h8q9 published
- 2026-06-26: disclosed: CVE-2026-54341 published to NVD