CVE-2026-62357: Dragonfly Buffer Overflow Vulnerability

CVE-2026-62357 Overview

CVE-2026-62357 is an integer overflow vulnerability [CWE-190] in Dragonfly, an in-memory data store used for modern application workloads. Versions prior to 1.40.0 mishandle dimension arguments passed to the CMS.INITBYDIM and CMS.INITBYPROB commands. The multiplication of width, depth, and sizeof(int64_t) overflows inside src/core/cms.cc, causing allocation of an undersized counter buffer. Subsequent CMS.INCRBY and CMS.QUERY operations then use the unbounded dimensions, resulting in out-of-bounds access. An unauthenticated remote client can corrupt or disclose adjacent heap memory and crash the server. The issue is fixed in version 1.40.0.

Critical Impact
Unauthenticated remote attackers can trigger heap memory corruption or disclosure and crash the Dragonfly server through crafted Count-Min Sketch initialization commands.

Affected Products

Dragonfly in-memory data store versions prior to 1.40.0
Deployments exposing the Dragonfly service endpoint to untrusted clients
Applications relying on the Count-Min Sketch (CMS) probabilistic data structure

Discovery Timeline

2026-08-18 - CVE-2026-62357 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62357

Vulnerability Analysis

Dragonfly implements the Count-Min Sketch probabilistic data structure through the CMS.INITBYDIM and CMS.INITBYPROB commands. These commands accept a width and depth that define the counter matrix backing the sketch. The implementation in src/core/cms.cc computes the buffer size as width * depth * sizeof(int64_t) without validating that the multiplication fits within a size_t. When the product wraps around, the allocator returns a buffer far smaller than the logical dimensions retained by the sketch object.

When CMS.INCRBY writes counters or CMS.QUERY reads them, the code indexes into the undersized allocation using the unbounded logical dimensions. This produces adjacent heap reads and writes that an unauthenticated remote client can trigger over the network.

Root Cause

The root cause is an unchecked integer multiplication during buffer size calculation for CMS counter storage. The vulnerable allocation path did not verify that width * depth * sizeof(int64_t) remained within size_t bounds before invoking the allocator. This is a classic [CWE-190] Integer Overflow to Buffer Overflow pattern.

Attack Vector

An unauthenticated remote attacker connects to the Dragonfly service and issues a CMS.INITBYDIM or CMS.INITBYPROB command with dimensions engineered to overflow the size calculation. Following that, CMS.INCRBY or CMS.QUERY commands drive the out-of-bounds heap accesses. The result is heap corruption, potential adjacent memory disclosure, and a server crash.

text

 namespace dfly {
 namespace {
 
+size_t AllocationSize(size_t len) {
+  CHECK_LE(len, std::numeric_limits<size_t>::max() / sizeof(int64_t));
+  return len * sizeof(int64_t);
+}
+
 uint32_t Offset(uint64_t h1, uint64_t h2, uint32_t row, uint32_t width) {
   uint32_t idx = static_cast<uint32_t>((h1 + (row * h2)) % width);
   return row * width + idx;

Source: GitHub Commit c004623. The patch introduces AllocationSize, which enforces len <= SIZE_MAX / sizeof(int64_t) before multiplication, eliminating the overflow condition.

Detection Methods for CVE-2026-62357

Indicators of Compromise

Unexpected Dragonfly process crashes or restarts correlated with client-issued CMS commands.
CMS.INITBYDIM or CMS.INITBYPROB commands submitting unusually large width or depth values from untrusted sources.
Heap corruption signatures in core dumps referencing src/core/cms.cc or CMS-related call frames.

Detection Strategies

Inspect application and proxy logs for CMS.INITBYDIM and CMS.INITBYPROB invocations where dimensions exceed practical Count-Min Sketch sizing.
Alert on Dragonfly server segmentation faults or abnormal terminations following CMS command sequences.
Monitor for network clients that issue CMS initialization commands without authenticating or that originate from outside the expected application tier.

Monitoring Recommendations

Enable command-level auditing on Dragonfly and forward logs to a centralized analytics platform for correlation with crash events.
Baseline expected CMS dimension ranges for legitimate application workloads and flag statistical outliers.
Track Dragonfly version inventory across environments to identify hosts still running versions prior to 1.40.0.

How to Mitigate CVE-2026-62357

Immediate Actions Required

Upgrade all Dragonfly deployments to version 1.40.0 or later, which introduces the AllocationSize bounds check.
Restrict network reachability of the Dragonfly service to trusted application hosts using firewall or security group rules.
Require authentication on Dragonfly instances and rotate credentials if the service was previously exposed without access controls.

Patch Information

The fix is available in Dragonfly 1.40.0. See the GitHub Release v1.40.0, the GitHub Security Advisory GHSA-cmmv-h748-v93x, the fix commit c004623, and Pull Request #7647. The patch bounds width * depth allocations to prevent size overflow.

Workarounds

Block or filter CMS.INITBYDIM and CMS.INITBYPROB commands at an application-level proxy until patching is complete.
Deny external network access to the Dragonfly port and require client access through a controlled intermediary.
Enforce strict input validation in application code so untrusted users cannot influence CMS dimension parameters.

bash

# Restrict Dragonfly to loopback and internal network only
# Example iptables rule allowing only an internal application subnet
iptables -A INPUT -p tcp --dport 6379 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP

# Verify installed Dragonfly version is >= 1.40.0
dragonfly --version