CVE-2026-104192
Deferred Deferred - Pending Action

Double-Free in Dragonfly In-Memory Data Store

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-104192
EUVD
EUVD-2026-98775

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dragonflydb dragonfly < 1.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in Dragonfly, an in-memory data store. An unauthenticated client can send a crafted serialized stream to the RESTORE command, causing the system to free the same memory object twice. This leads to allocator corruption, denial of service, and potentially allows code execution as the Dragonfly service account.

Impact Analysis

An attacker could exploit this to crash the Dragonfly service, disrupting access to the data store. In severe cases, it may allow the attacker to execute arbitrary code with the privileges of the Dragonfly service account, potentially leading to full system compromise.

Mitigation Strategies

Upgrade Dragonfly to version 1.40 or later to address the vulnerability. If upgrading is not immediately possible, disable the RESTORE command or restrict access to unauthenticated clients to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart