CVE-2026-111279: Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated client that can send commands to the affected Dragonfly instance can exploit it. No prior privileges or user interaction are required.
What request triggers the memory exhaustion?
An attacker can send HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER with a huge negative COUNT against a key containing one element. A single command can allocate unbounded memory and cause the OOM killer to terminate the instance.
What is the operational impact?
The primary impact is denial of service: the Dragonfly instance can be terminated, disrupting all clients using it. The provided information does not indicate confidentiality or integrity impact.
Which versions are known to be affected?
Dragonfly through version 2.0.2 is identified as affected.