PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111279 dragonflydb CVE debrief

CVE-2026-111279 is a high-severity vulnerability in Dragonfly, a database software, that allows unauthenticated clients to cause an out-of-memory (OOM) condition by sending a specially crafted command with a negative COUNT value to certain commands (HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER). This can lead to the termination of the instance for all clients. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity.

Vendor
dragonflydb
Product
dragonfly
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders who manage Dragonfly instances, especially those exposed to untrusted clients, should assess their exposure and prioritize patching or mitigating this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of Dragonfly deployments. They should review the supplied official advisory or CVE record to validate affected scope, severity, and

Why it matters

CVE-2026-111279 is a high-severity vulnerability in Dragonfly that allows unauthenticated clients to cause an out-of-memory condition, potentially leading to instance termination and performance degradation. Defenders managing Dragonfly instances, especially those exposed to untrusted clients, should assess their exposure and prioritize patching or mitigating this vulnerability.

  • Potential termination of Dragonfly instances for all clients
  • Possible OOM conditions leading to performance degradation
  • Unauthenticated clients can exploit this vulnerability
  • Verification of patching or mitigation is required

Technical summary

The vulnerability is caused by an unbounded memory allocation issue in the Dragonfly software. An attacker can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients. This issue affects Dragonfly through version 2.0.2 and can be mitigated by patching to a version greater than 2.0.2. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. Defenders should prioritize patching or mitigating this vulnerability as soon as possible, especially in environments where Dragonfly is exposed to untrusted clients.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as soon as possible, especially in environments where Dragonfly is exposed to untrusted clients.

Recommended defensive actions

  • Patch Dragonfly to a version greater than 2.0.2
  • Restrict access to Dragonfly to only trusted clients
  • Monitor Dragonfly instances for unusual activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an unbounded memory allocation issue in the Dragonfly software. An attacker can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients. The affected version is Dragonfly through 2.0.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111279 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111279

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111279 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111279

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBE

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111279.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dragonflydb/dragonfly/issues/8578

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/dragonflydb/dragonfly

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/dragonfly-through-2.0.2-unbounded-memory-allocation-via-negative-count-in-hrandfield-zrandmember-and-srandmember

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.