CVE-2026-104192— DragonflyDB stream RDB deserialization double-free
Quick assessment
Affected
dragonflydb dragonfly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dragonfly 是一个为现代应用负载设计的内存数据存储系统。在 1.40 版本之前，src/server/rdb_load.cc 文件中的 OpaqueObjLoader::CreateStream 函数会将一个流 NACK（否定确认）关联到消费者组的全局 PEL（未确认条目列表）和消费者本地的 PEL，随后在拒绝重复的消费者条目时释放共享对象。清理过程随后再次释放同一对象，导致双重释放漏洞。 在 Dragonfly 的默认配置中（未启用身份验证），未经身份验证的客户端可以通过向 RESTORE 命令发送精心构
Possible ATT&CK Techniques 3 AI
T1496 · Resource Hijacking T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dragonflydb | dragonfly | < 1.40 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104192
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DragonflyDB stream RDB deserialization double-free
Source: CVE Program / CVE List V5
Vulnerability Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
双重释放
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dragonflydb | dragonfly | < 1.40 | - |
|
II. Public POCs for CVE-2026-104192
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104192
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-104192 (2)
Vendor Advisories for CVE-2026-104192 (1)
IV. Related Vulnerabilities
Same product: dragonfly
-
CVE-2026-49254
Dragonfly Manager OAuth provider client_secret disclosure vi -
CVE-2026-54637
Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacke -
CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo -
CVE-2026-54341
Dragonfly: RESTORE operations may crash the server -
CVE-2026-47206
Dragonfly: RESP Protocol Injection via Lua redis.error_reply
Same vendor: dragonflydb
-
CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo -
CVE-2026-54341
Dragonfly: RESTORE operations may crash the server -
CVE-2026-47206
Dragonfly: RESP Protocol Injection via Lua redis.error_reply -
CVE-2025-52935
Integer Overflow or Wraparound vulnerability in dragonflydb/ -
CVE-2025-26269
Dragonfly 安全漏洞
Same weakness: CWE-415
-
CVE-2026-110599
L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importe -
CVE-2026-94370
Memory corruption (double free / use-after-free) vulnerabili -
CVE-2026-95635
Photoshop Desktop | Double Free (CWE-415) -
CVE-2026-108132
Windows Kerberos Elevation of Privilege Vulnerability -
CVE-2026-97830
Windows Internet Information Services Denial of Service Vuln
V. Comments for CVE-2026-104192
No comments yet