{"id":"CVE-2026-111279","title":"Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER","summary":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single comman…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-789"],"vendor":"dragonflydb","product":"dragonfly","affected":["dragonfly <= 2.0.2"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:43:23.862Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111279","references":[{"url":"https://github.com/dragonflydb/dragonfly/issues/8578","label":"GitHub Issue #8578"},{"url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483"},{"url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522"},{"url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984"},{"url":"https://github.com/dragonflydb/dragonfly"},{"url":"https://www.vulncheck.com/advisories/dragonfly-through-2.0.2-unbounded-memory-allocation-via-negative-count-in-hrandfield-zrandmember-and-srandmember","label":"VulnCheck Advisory: Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER"}],"tags":["cve.org"],"ingestedAt":"2026-10-15T22:48:25.448Z","slug":"CVE-2026-111279","body":"## Overview\n\nDragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.\n\n## Affected\n\n- `dragonfly <= 2.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}