CVE-2026-104192: DragonflyDB stream RDB deserialization double-free
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdbload.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Dragonfly instances running a version prior to 1.40 are affected. In the default configuration, authentication is disabled, so an unauthenticated client that can connect to the service can trigger the flaw.
What does an attacker need to do to exploit it?
An attacker needs network access to the Dragonfly service and must send a crafted serialized stream through the RESTORE command. No credentials or user interaction are required when the default authentication-disabled configuration is in use.
What is the likely impact of successful exploitation?
Exploitation causes allocator corruption through a double-free condition and can deny service. It may also permit attacker-controlled code execution under the Dragonfly service account.
Is a fixed release available?
The issue is described as affecting versions prior to 1.40, but the source fix has not yet been mapped to a published release. The available fix references include commit 6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e.