Heap Memory Corruption in Dragonfly Data Store

CVE-2026-62357

What is CVE-2026-62357?

The Dragonfly data store is vulnerable to a heap memory corruption issue that arises from improper handling of dimensions during buffer allocation in versions prior to 1.40.0. When CMS.INITBYDIM and CMS.INITBYPROB are invoked with dimensions that lead to an overflow, they allocate an undersized counter buffer. Consequently, functions like CMS.INCRBY and CMS.QUERY operate on these unbounded dimensions, thereby allowing unauthenticated remote clients to corrupt adjacent heap memory. This vulnerability poses a risk of server crashes and potential disclosure of sensitive data. The issue has been addressed in version 1.40.0.

References