Dragonflyoss Dragonfly vulnerabilities

• dragonflydb dragonfly Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER CVE-2026-111279 8.7 HighOctober 15, 2026
• dragonflydb dragonfly DragonflyDB stream RDB deserialization double-free CVE-2026-104192 9.6 CriticalOctober 13, 2026
• dragonflydb dragonfly DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write CVE-2026-62357 8.8 HighAugust 18, 2026
• dragonflyoss dragonfly Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile CVE-2026-54637 Fix available 5.5 MediumJuly 6, 2026
• dragonflyoss dragonfly Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth CVE-2026-49254 Fix available 2.9 LowJuly 2, 2026
• dragonflydb dragonfly Dragonfly: RESTORE operations may crash the server CVE-2026-54341 7.5 HighJune 26, 2026
• dragonflydb dragonfly Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer CVE-2026-47206 2.3 LowJune 26, 2026
• dragonflyoss dragonfly Dragonfly Manager Job API Allows Unauthenticated Access CVE-2026-24124 Fix available 8.9 HighJanuary 22, 2026
• dragonflyoss dragonfly Dragonfly tiny file download uses hard coded HTTP protocol CVE-2025-59410 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly has weak integrity checks for downloaded files CVE-2025-59354 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Manager generates mTLS certificates for arbitrary IP addresses CVE-2025-59353 Fix available 7.7 HighSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly allows arbitrary file read and write on a peer machine CVE-2025-59352 Fix available 6.9 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error CVE-2025-59351 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Timing attacks against Proxy’s basic authentication are possible CVE-2025-59350 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Directories created via os.MkdirAll are not checked for permissions CVE-2025-59349 Fix available 2.0 LowSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly incorrectly handles a task structure’s usedTraffic field CVE-2025-59348 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly Manager makes requests to external endpoints with disabled TLS authentication CVE-2025-59347 Fix available 2.7 LowSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly server-side request forgery vulnerability CVE-2025-59346 Fix available 5.5 MediumSeptember 17, 2025
• dragonflyoss dragonfly Dragonfly did not enable authentication for some Manager’s endpoints CVE-2025-59345 Fix available 7.7 HighSeptember 17, 2025
• dragonflydb dragonfly Integer Overflow or Wraparound vulnerability in dragonflydb/dragonfly CVE-2025-52935 9.4 CriticalJune 23, 2025
• dragonflydb dragonfly DragonflyDB Dragonfly through 1.28.2 allows authenticated users to cause a denial of service ... CVE-2025-26269 3.3 LowApril 17, 2025
• dragonflydb dragonfly DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service ... CVE-2025-26268 3.3 LowApril 17, 2025
• dragonflyoss dragonfly2, linuxfoundation dragonfly +1 more Dragonfly2 vulnerable to hard coded cyptographic key CVE-2023-27584 Fix available EPSS 33.9% 9.8 CriticalSeptember 19, 2024
• dragonflyoss dragonfly Improper Restriction of XML External Entity Reference in Dragonfly CVE-2022-41967 7.0 HighDecember 27, 2022