CVE-2026-62357: DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DragonflyDBto a version that resolves this vulnerability.Fixed in 1.40.0
Event History
Frequently Asked Questions
Which deployments are exposed?
DragonflyDB instances running versions earlier than 1.40.0 are affected if an unauthenticated remote client can connect to the server and issue CMS commands. The described attack does not require prior authentication.
What does exploitation require?
An attacker must initialize a Count-Min Sketch with CMS.INITBYDIM or CMS.INITBYPROB using dimensions that cause the counter-buffer size calculation to overflow, then use CMS.INCRBY or CMS.QUERY with those dimensions. This can corrupt or disclose adjacent heap memory and may crash the server.
What should be done to remediate the issue?
Upgrade DragonflyDB to version 1.40.0 or later. The provided information does not identify an alternative configuration-based mitigation.
How can I determine whether an instance is affected or has been exploited?
Review the running DragonflyDB version and treat versions earlier than 1.40.0 as affected. The supplied information does not provide a reliable log signature or other indicator that exploitation has already occurred.