CVE-2025-26269: Integer Underflow
Published Apr 17, 2025
·Updated
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
Affected Software
2 affected components
DragonflyDB Dragonfly<=1.28.2
DragonflyDB Dragonfly<1.29.0
Remediation
Patch Available
Event History
Apr 17, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-26269?
CVE-2025-26269 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2025-26269?
To fix CVE-2025-26269, upgrade DragonflyDB Dragonfly to version 1.28.3 or later.
3
Who is affected by CVE-2025-26269?
CVE-2025-26269 affects all authenticated users of DragonflyDB Dragonfly versions up to and including 1.28.2.
4
What type of attack does CVE-2025-26269 enable?
CVE-2025-26269 enables authenticated users to execute a Lua library command that crashes the daemon.
5
Is CVE-2025-26269 specific to any DragonflyDB features?
Yes, CVE-2025-26269 is related to the specific implementation of Lua library commands in DragonflyDB.