DragonflyDB vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 20265

Newest CVEs

• CVE-2026-111279

  Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

  dragonflydb · dragonfly

  High8.7
• CVE-2026-104192

  DragonflyDB stream RDB deserialization double-free

  dragonflydb · dragonfly

  Critical9.6
• CVE-2026-62357

  DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write

  dragonflydb · dragonfly

  High8.8
• CVE-2026-54341

  Dragonfly: RESTORE operations may crash the server

  dragonflydb · dragonfly

  High7.5
• CVE-2026-47206

  Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer

  dragonflydb · dragonfly

  Low2.3
• CVE-2025-52935

  Integer Overflow or Wraparound vulnerability in dragonflydb/dragonfly

  dragonflydb · dragonfly

  Critical9.4
• CVE-2025-26269

  DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that…

  DragonflyDB · Dragonfly

  Low3.3
• CVE-2025-26268

  DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the…

  DragonflyDB · Dragonfly

  Low3.3