DragonflyDB Dragonfly up to 1.39 OpaqueObjLoader src/server/rdb_load.cc CreateStream double free

Summaryinfo

A vulnerability has been found in DragonflyDB Dragonfly up to 1.39 and classified as critical. Affected is the function OpaqueObjLoader::CreateStream of the file src/server/rdb_load.cc of the component OpaqueObjLoader. Performing a manipulation results in double free. This vulnerability is known as CVE-2026-104192. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in DragonflyDB Dragonfly up to 1.39. This affects the function OpaqueObjLoader::CreateStream of the file src/server/rdb_load.cc of the component OpaqueObjLoader. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-104192 since 10/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.40 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• DragonflyDB

Name

• Dragonfly

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39

Website

• Product: https://github.com/dragonflydb/dragonfly/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion