CVE-2026-54341: DragonflyDB DoS Vulnerability

CVE-2026-54341 Overview

CVE-2026-54341 is an out-of-bounds read vulnerability [CWE-125] in DragonflyDB, an in-memory data store used for modern application workloads. A crafted RESTORE payload triggers an out-of-bounds read in the listpack collection loaders, causing the server process to crash with a SIGSEGV. Because DragonflyDB requires no authentication by default and RESTORE is a standard keyspace command, an unauthenticated remote attacker can crash the server with a single command of roughly 24 bytes. This results in a remote, repeatable denial of service against any exposed DragonflyDB instance running a version prior to 1.39.0.

Critical Impact
An unauthenticated remote attacker can crash a DragonflyDB server process with a single ~24-byte RESTORE command, producing a repeatable denial of service.

Affected Products

DragonflyDB versions prior to 1.39.0
Deployments running with the default (no authentication) configuration
Any DragonflyDB instance exposed to untrusted networks accepting keyspace commands

Discovery Timeline

2026-06-26 - CVE-2026-54341 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-54341

Vulnerability Analysis

The vulnerability affects DragonflyDB's listpack collection loaders, which parse serialized data supplied through the RESTORE keyspace command. RESTORE accepts a payload representing a serialized value and reconstructs it in memory under a specified key. When the loader processes a maliciously crafted payload, it reads memory outside the bounds of the allocated buffer.

The out-of-bounds read triggers a segmentation fault (SIGSEGV) that terminates the entire server process. DragonflyDB runs as a single multi-threaded process, so the crash takes down all client connections and keyspace availability. The vulnerability is classified under [CWE-125] Out-of-bounds Read.

Root Cause

The root cause is missing bounds validation inside the listpack deserialization path used by the collection loaders. The loaders trust size and offset fields embedded in the RESTORE payload without verifying them against the actual buffer length. A crafted payload supplies values that cause the loader to dereference memory beyond the buffer, producing an unrecoverable fault.

Attack Vector

The attack requires only network reachability to the DragonflyDB port. DragonflyDB ships without authentication enabled by default, so an unauthenticated remote attacker can issue the malicious RESTORE command directly. The payload is approximately 24 bytes, making the attack trivial to script and repeat after the service restarts. See the GitHub Security Advisory GHSA-cwjr-j869-h8q9 and GitHub Pull Request #7502 for technical details of the flawed parsing path and the corresponding fix.

Detection Methods for CVE-2026-54341

Indicators of Compromise

Unexpected DragonflyDB process termination with SIGSEGV recorded in system logs or container orchestrator restart events.
Inbound RESTORE commands from untrusted sources, particularly with small payload sizes near 24 bytes.
Repeated client reconnections following abrupt server termination, correlating with crash-loop patterns.

Detection Strategies

Monitor DragonflyDB process lifecycle events for crash signals such as SIGSEGV and correlate them with recent inbound commands.
Inspect network telemetry for RESTORE traffic originating outside expected application clients or replication peers.
Alert on version banners reporting DragonflyDB releases older than 1.39.0 on any exposed listener.

Monitoring Recommendations

Enable core dump collection on DragonflyDB hosts and forward crash artifacts to a central analysis pipeline.
Ingest DragonflyDB and container runtime logs into a centralized log platform to identify repeated restart patterns.
Track listener exposure through periodic external scans to confirm the service is not reachable from untrusted networks.

How to Mitigate CVE-2026-54341

Immediate Actions Required

Upgrade all DragonflyDB instances to version 1.39.0 or later, which contains the fix for the listpack loader.
Restrict network access to the DragonflyDB port so only trusted application hosts can reach the service.
Enable authentication by configuring a strong password via the --requirepass flag or equivalent deployment setting.

Patch Information

The vulnerability is fixed in DragonflyDB 1.39.0. The upstream fix is tracked in GitHub Pull Request #7502, which adds bounds validation to the listpack collection loaders. Details are also published in GitHub Security Advisory GHSA-cwjr-j869-h8q9.

Workarounds

Place DragonflyDB behind a firewall or private network segment that blocks untrusted client connectivity.
Configure authentication so unauthenticated clients cannot issue keyspace commands such as RESTORE.
Use command renaming or ACL controls, where available, to disable the RESTORE command for untrusted users until the patch is applied.

bash

# Configuration example: require authentication and bind to a private interface
dragonfly --requirepass "$(openssl rand -base64 32)" \
          --bind 10.0.0.10 \
          --port 6379