CVE-2026-47206

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47206", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T22:25:21.257Z", "datePublished": "2026-06-26T16:39:27.710Z", "dateUpdated": "2026-06-26T17:31:48.061Z"}, "containers": {"cna": {"title": "Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h"}, {"name": "https://github.com/dragonflydb/dragonfly/issues/7328", "tags": ["x_refsource_MISC"], "url": "https://github.com/dragonflydb/dragonfly/issues/7328"}, {"name": "https://github.com/dragonflydb/dragonfly/pull/7332", "tags": ["x_refsource_MISC"], "url": "https://github.com/dragonflydb/dragonfly/pull/7332"}], "affected": [{"vendor": "dragonflydb", "product": "dragonfly", "versions": [{"version": "< 1.38.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:40:13.402Z"}, "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9."}], "source": {"advisory": "GHSA-h77h-c6hc-qc9h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/dragonflydb/dragonfly/issues/7328", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T17:31:44.526254Z", "id": "CVE-2026-47206", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T17:31:48.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47206", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T17:31:44.526254Z"}}}], "references": [{"url": "https://github.com/dragonflydb/dragonfly/issues/7328", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T17:31:32.956Z"}}], "cna": {"title": "Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer", "source": {"advisory": "GHSA-h77h-c6hc-qc9h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "dragonflydb", "product": "dragonfly", "versions": [{"status": "affected", "version": "< 1.38.9"}]}], "references": [{"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h", "name": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dragonflydb/dragonfly/issues/7328", "name": "https://github.com/dragonflydb/dragonfly/issues/7328", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dragonflydb/dragonfly/pull/7332", "name": "https://github.com/dragonflydb/dragonfly/pull/7332", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:40:13.402Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47206", "state": "PUBLISHED", "dateUpdated": "2026-06-26T17:31:48.061Z", "dateReserved": "2026-05-18T22:25:21.257Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T16:39:27.710Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dragonfly", "vendor": "dragonflydb", "versions": [{"status": "affected", "version": "< 1.38.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9."}, {"lang": "es", "value": "Dragonfly es un almac\u00e9n de datos en memoria dise\u00f1ado para cargas de trabajo de aplicaciones modernas. Antes de la versi\u00f3n 1.39.9, Dragonfly presenta una Inyecci\u00f3n de Protocolo RESP a trav\u00e9s de Lua redis.error_reply() en EvalSerializer. Un usuario autenticado puede inyectar mensajes RESP arbitrarios en el flujo de respuesta de la conexi\u00f3n, lo que podr\u00eda causar una desincronizaci\u00f3n de la respuesta en clientes de pool de conexiones. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.39.9."}], "id": "CVE-2026-47206", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47206", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T17:31:44.526254Z", "version": "2.0.3"}}]}, "published": "2026-06-26T18:16:58.810", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/dragonflydb/dragonfly/issues/7328"}, {"source": "security-advisories@github.com", "url": "https://github.com/dragonflydb/dragonfly/pull/7332"}, {"source": "security-advisories@github.com", "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/dragonflydb/dragonfly/issues/7328"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.38.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dragonfly", "source": "cna", "vendor": "dragonflydb"}, "product": "dragonfly", "vendor": "dragonflydb"}], "created": "2026-06-26T18:30:05.282946+00:00", "updated": "2026-06-26T23:00:08.472584+00:00", "vendors": ["dragonflydb", "dragonflydb$PRODUCT$dragonfly"]}