Unbounded Memory Allocation Vulnerability in Dragonfly by DragonflyDB
CVE-2026-111279
8.7HIGH
What is CVE-2026-111279?
DragonflyDB versions up to 2.0.2 are susceptible to an unbounded memory allocation vulnerability caused by negative COUNT parameters in the commands HRANDFIELD, ZRANDMEMBER, and SRANDMEMBER. This flaw allows unauthenticated clients to exhaust the server's memory by sending a command with an unrealistic negative COUNT, triggering the Out Of Memory (OOM) killer. When this occurs, the affected instance becomes unresponsive, impacting all connected clients. Users are advised to update to the latest versions and implement safeguards against such unauthorized commands.
Affected Version(s)
dragonfly 0 <= 2.0.2