CVE-2026-47206: Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.errorreply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dragonflyto a version that resolves this vulnerability.Fixed in 1.39.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47206?
CVE-2026-47206 is rated with a risk score of 33.
What can an attacker do with CVE-2026-47206?
An attacker can inject arbitrary RESP messages into the response stream of an authenticated user.
How do I fix CVE-2026-47206?
To fix CVE-2026-47206, upgrade Dragonfly to version 1.39.9 or later.
Who is affected by CVE-2026-47206?
Any user of Dragonfly prior to version 1.39.9 may be affected by CVE-2026-47206.
What is the impact of CVE-2026-47206 exploitation?
Exploitation of CVE-2026-47206 can lead to potential disruption of service or data manipulation.