CVE-2026-47206 Overview
CVE-2026-47206 is a RESP (REdis Serialization Protocol) injection vulnerability in Dragonfly, an in-memory data store built for modern application workloads. The flaw resides in the EvalSerializer component and is triggered through Lua scripting via redis.error_reply(). An authenticated user can inject arbitrary RESP messages into the connection's response stream. This can cause response desynchronization in clients that rely on connection pooling. The issue is tracked under CWE-116: Improper Encoding or Escaping of Output and is fixed in Dragonfly version 1.39.9.
Critical Impact
Authenticated attackers can desynchronize responses in connection-pool clients, potentially causing one client to receive another client's data.
Affected Products
- Dragonfly in-memory data store, all versions prior to 1.39.9
- Applications relying on Dragonfly connection pooling for RESP-based communication
- Multi-tenant deployments where Lua scripting is permitted for authenticated users
Discovery Timeline
- 2026-06-26 - CVE-2026-47206 published to the National Vulnerability Database
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-47206
Vulnerability Analysis
Dragonfly implements the RESP protocol used by Redis clients. The EvalSerializer handles the output of Lua scripts executed through the EVAL command. When a Lua script calls redis.error_reply() with a caller-controlled string, the serializer fails to properly encode or escape RESP framing characters. This maps directly to CWE-116: Improper Encoding or Escaping of Output.
The attacker requires authenticated access and the ability to execute Lua scripts. The impact is confined to protocol integrity: no direct compromise of confidentiality, integrity, or availability of the server data occurs. However, downstream clients sharing a pooled connection may parse injected frames as legitimate responses.
Root Cause
The root cause is missing RESP-level output encoding inside EvalSerializer when handling redis.error_reply() payloads. User-supplied error strings are written into the response stream without neutralizing carriage return and line feed sequences (\r\n) that delimit RESP messages. This allows an attacker to terminate the current reply and append additional, forged RESP frames.
Attack Vector
Exploitation proceeds over the network against an authenticated Dragonfly session. The attacker submits an EVAL command whose Lua body calls redis.error_reply() with a string containing RESP framing metacharacters. Dragonfly emits the crafted bytes verbatim, so the response stream now contains two logical replies. A connection-pool client that returns the connection to the pool after reading only the first frame will hand the injected frame to the next borrower. The next application request then receives attacker-controlled data as its response.
No verified public proof-of-concept is available. Refer to the GitHub Security Advisory GHSA-h77h-c6hc-qc9h and GitHub Issue #7328 for maintainer-authored technical details.
Detection Methods for CVE-2026-47206
Indicators of Compromise
- Dragonfly instances running versions prior to 1.39.9 that accept authenticated EVAL commands from untrusted tenants
- Application error logs showing type mismatches or malformed responses returned to unrelated queries
- RESP payloads from EVAL responses containing embedded \r\n sequences followed by additional RESP type prefixes (+, -, :, $, *)
Detection Strategies
- Inspect Dragonfly command logs for EVAL scripts that invoke redis.error_reply() with dynamic or user-controlled arguments
- Enable protocol-level auditing on any proxy or sidecar in front of Dragonfly to flag responses with unexpected multi-frame structure
- Correlate client-side deserialization errors with concurrent EVAL activity from other authenticated principals
Monitoring Recommendations
- Track the Dragonfly server version across the fleet and alert on any instance below 1.39.9
- Monitor authentication and ACL events to identify which principals hold Lua scripting privileges
- Baseline the rate of EVAL calls and error-reply frames per client, and alert on unusual spikes
How to Mitigate CVE-2026-47206
Immediate Actions Required
- Upgrade Dragonfly to version 1.39.9 or later, which contains the fix delivered in GitHub Pull Request #7332
- Restrict Lua scripting privileges via ACLs so only trusted administrative principals can execute EVAL and EVALSHA
- Audit connection-pool client libraries and consider disabling connection reuse in shared or multi-tenant environments until patching completes
Patch Information
The vulnerability is fixed in Dragonfly 1.39.9. Maintainers merged the corrective change in GitHub Pull Request #7332, which adds proper encoding of error-reply payloads inside EvalSerializer. Full advisory details are published in GHSA-h77h-c6hc-qc9h and tracked in GitHub Issue #7328.
Workarounds
- Revoke the Lua scripting capability from untrusted users using Dragonfly ACLs until the upgrade is deployed
- Terminate and recreate pooled connections after any error response to reduce the window for desynchronization
- Place a RESP-aware proxy in front of Dragonfly that validates single-frame responses to EVAL commands
# Verify the running Dragonfly version and upgrade if below 1.39.9
dragonfly --version
# Example ACL restriction: remove EVAL/EVALSHA from an untrusted user
# (adjust to match your ACL provisioning workflow)
ACL SETUSER appuser -eval -evalsha -script
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
