CVE-2026-62357 in Dragonfly
Summary
by MITRE • 08/18/2026
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
Dragonfly serves as a high-performance in-memory data store designed for modern application workloads, offering capabilities similar to Redis but with enhanced performance characteristics. The vulnerability identified involves integer overflow issues within the Count-Min Sketch (CMS) implementation, specifically affecting commands CMS.INITBYDIM and CMS.INITBYPROB prior to version 1.40.0. These commands are used to initialize a probabilistic data structure that allows for frequency estimation of elements in a stream with sub-linear memory usage. The core technical flaw arises during the calculation of buffer size required for these sketches, where the multiplication of dimensions width and depth by the size of an int64_t can result in integer overflow. This arithmetic error leads to the allocation of a significantly undersized counter buffer on the heap compared to what is logically expected based on the input parameters provided by the client.
The operational impact of this vulnerability is severe due to how subsequent commands interact with the improperly allocated memory structure. While CMS.INITBYDIM and CMS.INITBYPROB allocate insufficient space, other commands such as CMS.INCRBY and CMS.QUERY operate using the unbounded dimensions originally specified during initialization rather than checking against the actual allocated buffer size. Consequently, when these operations attempt to access or modify data within the sketch, they write beyond the bounds of the allocated memory region. This out-of-bounds write condition allows an unauthenticated remote client to corrupt adjacent heap memory structures, potentially leading to arbitrary code execution if specific exploitation techniques are applied, or more commonly resulting in server crashes due to segmentation faults and memory access violations. The ability for a remote attacker to trigger this behavior without authentication significantly lowers the barrier for successful exploitation, posing a critical risk to service availability and data integrity.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, which describes situations where an integer calculation results in a value that cannot be represented within the allocated storage space, leading to unexpected behavior such as buffer overflows. Furthermore, the exploitation vector corresponds to CWE-787 Out-of-bounds Write, indicating that memory is written outside of its intended boundary. In terms of attack tactics and techniques, this scenario maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if interpreted through automated exploit frameworks or more directly to resource manipulation aspects found in initial access and execution phases where stability is compromised for denial-of-service purposes. The lack of authentication required makes it particularly dangerous in environments where Dragonfly instances are exposed to untrusted networks without proper network-level access controls.
Mitigation strategies primarily involve upgrading the Dragonfly installation to version 1.40.0 or later, which contains patches addressing these integer overflow checks and ensuring that buffer allocations match the logical requirements of the data structures being manipulated. For environments where immediate patching is not feasible, implementing strict network segmentation rules can help mitigate risk by restricting access to the Dragonfly service only from trusted IP addresses or internal subnets. Additionally, deploying Web Application Firewalls (WAFs) or intrusion detection systems that monitor for anomalous memory usage patterns or specific command sequences associated with CMS operations may provide an additional layer of defense against exploitation attempts until a permanent fix can be applied. Regular security audits and static code analysis tools should also be employed to detect similar integer arithmetic vulnerabilities in custom configurations or extensions interacting with the data store.