Memory Corruption Vulnerability in Dragonfly Data Store by DragonflyDB

CVE-2026-104192

What is CVE-2026-104192?

A serious memory corruption vulnerability exists in Dragonfly, an in-memory data store developed by DragonflyDB. Specifically, the OpaqueObjLoader::CreateStream function in src/server/rdb_load.cc has a flaw that allows an unauthenticated client to exploit a double-free condition. When an attacker sends a crafted serialized stream to the RESTORE command while operating with default settings, where authentication is disabled, it can lead to allocator corruption. This exploit not only causes a denial of service but could also allow an attacker to execute arbitrary code as the Dragonfly service account. As of now, the fix for this vulnerability has not been applied to any released versions.

References