CVE-2026-54341

{
  "id": "CVE-2026-54341",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T18:17:00.417",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command — a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0."
    },
    {
      "lang": "es",
      "value": "Dragonfly es un almacén de datos en memoria construido para cargas de trabajo de aplicaciones modernas. Antes de 1.39.0, una carga útil RESTORE manipulada desencadena una lectura fuera de límites en los cargadores de colecciones listpack de DragonflyDB, provocando la caída de todo el proceso del servidor (SIGSEGV). Debido a que DragonflyDB no requiere autenticación por defecto y RESTORE es un comando normal de espacio de claves, un atacante remoto no autenticado puede hacer caer el servidor con un solo comando de ~24 bytes - una denegación de servicio remota y repetible. Esta vulnerabilidad está corregida en 1.39.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dragonflydb",
          "product": "dragonfly",
          "versions": [
            {
              "version": "< 1.39.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T18:31:59.890470Z",
          "id": "CVE-2026-54341",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dragonflydb/dragonfly/pull/7502",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}