Denial of Service Vulnerability in DragonflyDB by Dragonfly
CVE-2025-26268

6.5MEDIUM

Key Information:

Vendor

Dragonflydb

Status
Dragonfly
Vendor
CVE Published:
17 April 2025

What is CVE-2025-26268?

Authenticated users of DragonflyDB prior to version 1.27.0 can exploit a vulnerability resulting from inadequate validation of scan cursor inputs. By sending specially crafted Redis commands, these users can trigger a crash of the daemon, leading to a denial of service. This behavior highlights the necessity for robust input validation and security practices within the system to prevent service disruptions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Dragonfly 0 < 1.27.0

References

https://github.com/dragonflydb/dragonfly/issues/4466
https://github.com/dragonflydb/dragonfly/commit/d1fac0f91...
https://github.com/dragonflydb/dragonfly/compare/v1.26.4....

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.