Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-111279 Overview
CVE-2026-111279 is an unbounded memory allocation vulnerability affecting Dragonfly through version 2.0.2. The flaw resides in the handling of the HRANDFIELD, ZRANDMEMBER, and SRANDMEMBER commands when a negative COUNT parameter is supplied. An unauthenticated client can issue a single command against a one-element key with a large negative COUNT value, causing the server to attempt a massive allocation. The resulting memory pressure triggers the Linux Out-Of-Memory (OOM) killer, which terminates the Dragonfly process and disconnects every connected client. The weakness is tracked as [CWE-789: Memory Allocation with Excessive Size Value].
Critical Impact
A single unauthenticated network request can terminate a Dragonfly instance, producing an availability outage for all clients relying on the cache or data store.
Affected Products
- Dragonfly through version 2.0.2
- Deployments exposing HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER to untrusted clients
- Dragonfly instances running without network-level access controls
Discovery Timeline
- 2026-10-15 - CVE-2026-111279 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-111279
Vulnerability Analysis
Dragonfly implements the Redis-compatible HRANDFIELD, ZRANDMEMBER, and SRANDMEMBER commands, each of which accepts a COUNT parameter. A positive COUNT returns up to that many unique elements, while a negative COUNT instructs the server to return |COUNT| elements with replacement, allowing duplicates. The server allocates a response buffer proportional to the absolute value of COUNT before iterating the underlying structure. The command implementations do not validate COUNT against the actual key cardinality or against a safe upper bound. An attacker can therefore target a key containing a single element and request a very large negative count, forcing the server to allocate memory far exceeding system limits. The excessive allocation causes the kernel OOM killer to terminate the Dragonfly process, denying service to every client.
Root Cause
The root cause is missing bounds enforcement on the COUNT argument before memory allocation. Source review of hset_family.cc, set_family.cc, and zset_family.cc shows that the random-element paths size result containers based on the user-supplied magnitude without clamping against system memory, process limits, or the number of elements in the target key.
Attack Vector
Exploitation requires only network reachability to the Dragonfly listener. No authentication is required when the instance is deployed with default or anonymous access. An attacker opens a connection, writes a one-element key with any command such as SADD k x, and then issues SRANDMEMBER k -2147483648. The server attempts to construct a reply buffer sized for billions of elements and is killed by the OOM mechanism, terminating all sessions.
See the VulnCheck Advisory for DragonflyDB and DragonflyDB Issue #8578 for additional technical context.
Detection Methods for CVE-2026-111279
Indicators of Compromise
- Dragonfly process termination entries in dmesg or /var/log/messages referencing the OOM killer and the dragonfly binary.
- Sudden mass client disconnects correlated with a spike in resident set size on the Dragonfly host.
- Command audit logs showing HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER with large negative COUNT values from unexpected source addresses.
Detection Strategies
- Enable Dragonfly command logging or front the service with a protocol-aware proxy to capture command arguments and flag negative COUNT values that exceed a safe threshold.
- Alert on process restarts of the Dragonfly service combined with kernel OOM events on the same host.
- Baseline normal memory growth of the Dragonfly process and alert on rapid allocation spikes within short time windows.
Monitoring Recommendations
- Export Dragonfly metrics such as used_memory and connection counts to your observability stack and alert on abrupt drops to zero.
- Monitor host-level oom_kill counters through node_exporter or an equivalent agent.
- Correlate network telemetry showing unauthenticated inbound traffic to the Dragonfly port with service availability events.
How to Mitigate CVE-2026-111279
Immediate Actions Required
- Upgrade Dragonfly to a release later than 2.0.2 once the vendor fix is published; track DragonflyDB Issue #8578 for status.
- Restrict network access to the Dragonfly port using firewall rules, security groups, or service mesh policies so only trusted application tiers can connect.
- Require authentication on every Dragonfly instance and rotate any shared credentials that may have been exposed.
Patch Information
At the time of publication, the vendor advisory references source locations in hset_family.cc, set_family.cc, and zset_family.cc where the unchecked COUNT handling lives. Monitor the DragonflyDB GitHub Repository and the VulnCheck Advisory for DragonflyDB for the fixed version and apply it as soon as it is available.
Workarounds
- Place Dragonfly behind a protocol-aware proxy that rejects HRANDFIELD, ZRANDMEMBER, and SRANDMEMBER commands containing negative COUNT values.
- Use Dragonfly's command renaming or disabling features, where supported, to block the three affected commands until a patched build is deployed.
- Enforce per-process memory limits with systemd directives such as MemoryMax= so an OOM event is contained and the service restarts quickly under supervision.
- Isolate Dragonfly in a dedicated network segment and require mutual TLS or VPN access to reduce the pool of potential attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
