CVE-2026-54341

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54341", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T19:23:22.317Z", "datePublished": "2026-06-26T16:42:15.298Z", "dateUpdated": "2026-06-26T18:32:22.364Z"}, "containers": {"cna": {"title": "Dragonfly: RESTORE operations may crash the server", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9"}, {"name": "https://github.com/dragonflydb/dragonfly/pull/7502", "tags": ["x_refsource_MISC"], "url": "https://github.com/dragonflydb/dragonfly/pull/7502"}], "affected": [{"vendor": "dragonflydb", "product": "dragonfly", "versions": [{"version": "< 1.39.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:42:15.298Z"}, "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command \u2014 a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0."}], "source": {"advisory": "GHSA-cwjr-j869-h8q9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T18:31:59.890470Z", "id": "CVE-2026-54341", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:32:22.364Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54341", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T18:31:59.890470Z"}}}], "references": [{"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T18:32:18.243Z"}}], "cna": {"title": "Dragonfly: RESTORE operations may crash the server", "source": {"advisory": "GHSA-cwjr-j869-h8q9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "dragonflydb", "product": "dragonfly", "versions": [{"status": "affected", "version": "< 1.39.0"}]}], "references": [{"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9", "name": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dragonflydb/dragonfly/pull/7502", "name": "https://github.com/dragonflydb/dragonfly/pull/7502", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command \u2014 a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T16:42:15.298Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54341", "state": "PUBLISHED", "dateUpdated": "2026-06-26T18:32:22.364Z", "dateReserved": "2026-06-12T19:23:22.317Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T16:42:15.298Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dragonfly", "vendor": "dragonflydb", "versions": [{"status": "affected", "version": "< 1.39.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command \u2014 a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0."}, {"lang": "es", "value": "Dragonfly es un almac\u00e9n de datos en memoria construido para cargas de trabajo de aplicaciones modernas. Antes de 1.39.0, una carga \u00fatil RESTORE manipulada desencadena una lectura fuera de l\u00edmites en los cargadores de colecciones listpack de DragonflyDB, provocando la ca\u00edda de todo el proceso del servidor (SIGSEGV). Debido a que DragonflyDB no requiere autenticaci\u00f3n por defecto y RESTORE es un comando normal de espacio de claves, un atacante remoto no autenticado puede hacer caer el servidor con un solo comando de ~24 bytes - una denegaci\u00f3n de servicio remota y repetible. Esta vulnerabilidad est\u00e1 corregida en 1.39.0."}], "id": "CVE-2026-54341", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54341", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T18:31:59.890470Z", "version": "2.0.3"}}]}, "published": "2026-06-26T18:17:00.417", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/dragonflydb/dragonfly/pull/7502"}, {"source": "security-advisories@github.com", "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.39.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "dragonfly", "source": "cna", "vendor": "dragonflydb"}, "product": "dragonfly", "vendor": "dragonflydb"}], "created": "2026-06-26T18:30:05.282801+00:00", "updated": "2026-06-26T22:45:05.690681+00:00", "vendors": ["dragonflydb", "dragonflydb$PRODUCT$dragonfly"]}