{"id":"CVE-2026-104192","published":"2026-10-13T15:17:31.087","lastModified":"2026-10-13T16:17:11.333","description":"Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-415"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e","tags":[]},{"url":"https://github.com/dragonflydb/dragonfly/pull/7929","tags":[]},{"url":"https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh","tags":[]}],"exploitRefs":[{"url":"https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e","tags":[]},{"url":"https://github.com/dragonflydb/dragonfly/pull/7929","tags":[]},{"url":"https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh","tags":[]}],"hasPoc":true,"ai":{"summary":"This is a double-free vulnerability in Dragonfly's stream processing that can lead to allocator corruption and remote code execution when an unauthenticated client sends crafted stream data via RESTORE command. The flaw affects versions prior to 1.40.","exploitability":"Exploitation is relatively straightforward as it requires only sending a crafted serialized stream to the RESTORE command, with no authentication needed since the default configuration disables authentication.","blast_radius":"The impact could be severe across all Dragonfly instances running in default configuration, potentially allowing attackers to execute arbitrary code as the service account with high privilege.","remediation":"Upgrade to version 1.40 or later immediately to remediate this critical vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","dos","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:53:34.277Z"}}