CVE-2026-111279— Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Quick assessment
Affected
dragonflydb dragonfly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dragonfly 在版本 2.0.2 及之前版本中存在一个无界内存分配漏洞，未认证的攻击者可通过向 、 或 命令传入负数的 COUNT 参数，导致内存耗尽。攻击者只需对包含单个元素的大键发送一条带有极大负数 COUNT 值的命令，即可触发操作系统的 OOM（Out Of Memory）杀手机制，从而终止该实例的运行，导致所有客户端连接中断。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dragonflydb | dragonfly | ≤ 2.0.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111279
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Source: CVE Program / CVE List V5
Vulnerability Description
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dragonflydb | dragonfly | 0 ~ 2.0.2 | - |
|
II. Public POCs for CVE-2026-111279
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111279
请登录查看更多情报信息。
Proof of Concept for CVE-2026-111279 (1)
Vendor Pages for CVE-2026-111279 (2)
IV. Related Vulnerabilities
Same product: dragonfly
-
CVE-2026-104192
DragonflyDB stream RDB deserialization double-free -
CVE-2026-49254
Dragonfly Manager OAuth provider client_secret disclosure vi -
CVE-2026-54637
Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacke -
CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo -
CVE-2026-54341
Dragonfly: RESTORE operations may crash the server
Same vendor: dragonflydb
-
CVE-2026-104192
DragonflyDB stream RDB deserialization double-free -
CVE-2026-62357
DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remo -
CVE-2026-54341
Dragonfly: RESTORE operations may crash the server -
CVE-2026-47206
Dragonfly: RESP Protocol Injection via Lua redis.error_reply -
CVE-2025-52935
Integer Overflow or Wraparound vulnerability in dragonflydb/
Same weakness: CWE-789
-
CVE-2026-110258
OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Mult -
CVE-2026-110257
OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via Boot -
CVE-2026-85324
Active Directory Federation Services (AD FS) Denial of Servi -
CVE-2026-109149
beautifier js-beautify memory allocation -
CVE-2020-37280
cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR
V. Comments for CVE-2026-111279
No comments yet