# CVE-2026-54341: DragonflyDB denial of service via crafted RESTORE payload

Source: https://junglewise.ai/threats/cve-2026-54341-dragonflydb-denial-of-service-via-crafted-restore-payload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-54341 · Severity: high · CVSS 7.5 · Published 2026-06-26

Dragonfly is a high-performance in-memory data store used for modern application workloads. A vulnerability in how the system handles data restoration commands allows an unauthenticated remote attacker to crash the entire server process with a very small, specially crafted command. This results in a complete service outage and loss of availability for all connected applications and data shards.

Technologies: [DragonflyDB Dragonfly](https://junglewise.ai/threats/technologies/dragonfly). Vendors: [DragonflyDB](https://junglewise.ai/threats/vendors/dragonflydb).

## Quick answers

**Is CVE-2026-54341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54341 being exploited in the wild.

**How severe is CVE-2026-54341?** High severity, with a CVSS score of 7.5, published 26 June 2026.

**Which products and versions are affected?** DragonflyDB Dragonfly < 1.39.0.

**Is there a fix for CVE-2026-54341?** A patch was published on 2026-06-03: Fix merged in pull request #7502 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54341 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-54341?** Check whether you run DragonflyDB Dragonfly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in DragonflyDB's listpack collection loaders (affecting SET, HASH, ZSET, LIST, and STREAM types). The root cause is the use of shallow integrity checks (lpValidateIntegrity with deep=0) during the RESTORE command, which validates the listpack header but ignores interior entry lengths. An attacker can provide a payload declaring a large entry length (e.g., 0x7fffffff) without providing the actual data; when the loader iterates the collection, it trusts this length, leading to a SIGSEGV. Since DragonflyDB requires no authentication by default and RESTORE is a standard keyspace command, this allows for a repeatable, unauthenticated denial of service. The issue is fixed in version 1.39.0 by implementing deep integrity validation for untrusted RESTORE inputs.

## Affected products

- DragonflyDB Dragonfly < 1.39.0

## Timeline

- 2026-06-03: patched: Fix merged in pull request #7502
- 2026-06-15: advisory: GitHub Security Advisory GHSA-cwjr-j869-h8q9 published
- 2026-06-26: disclosed: CVE-2026-54341 published to NVD

## References

- [https://github.com/dragonflydb/dragonfly/pull/7502](https://github.com/dragonflydb/dragonfly/pull/7502)
- [https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9](https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9)

## Related threats

- [Dragonfly double-free in RDB stream consumer group loading](https://junglewise.ai/threats/cve-2026-104192-dragonfly-is-an-in-memory-data-store-built-for-modern)
- [DragonflyDB Dragonfly RESP protocol injection in EvalSerializer](https://junglewise.ai/threats/cve-2026-47206-dragonflydb-dragonfly-resp-protocol-injection-in-evalserializer)