CVE-2026-111279

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111279
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111279.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111279
Published
2026-10-15T21:43:23Z
Modified
2026-10-20T11:18:20Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Details

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111279.json"
}
References

Affected packages

Git / github.com/dragonflydb/dragonfly

Affected ranges

Type
GIT
Repo
https://github.com/dragonflydb/dragonfly
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
5e2a444fe2a8a3d72bf131c96f6e6a09918e37bd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2.0.2"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.0.2"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

i1.*
i1.33.3
i1.36.1
i1.36.2
i1.36.3
i1.39.10
i1.39.11
i1.39.2
i1.39.4
i1.39.6
i1.39.8
i1.39.9
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.2.0
v0.3.0
v0.3.0-alpha
v0.3.1
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.2.0
v1.2.1
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.4.0
v1.40.0
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.2
w0.*
w0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111279.json"