CVE-2026-111279 — Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZR…
Published: 2026-10-15 · CVSS: 8.7 · CVSS 4.0
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7