Dragonfly: Double-free in RESTORE stream consumer group loading

Summary

Dragonfly, an in-memory data store, versions below 1.40 contain a double-free when loading a crafted stream consumer group via RESTORE. The same shared pending-entry structure is freed twice when consumers are deleted. With authentication disabled, which is the default, an unauthenticated client can trigger this to cause denial of service, allocator corruption and potentially code execution as the Dragonfly service account.

Affected

• Dragonfly versions < 1.40 (per CVE record and GitHub advisory)
• Default configuration with authentication disabled
• Note: NVD/CVSS vector uses AV:A; the advisory describes remote exploitation. Version range not independently confirmed.

Fixed in

• Fix committed in commit 6c6b27a and PR #7929.
• Vendor advisory lists no patched version; the first fixed release is unknown.
• Do not assume 1.40 is fixed until the vendor confirms.

Workaround

• Vendor-confirmed workaround: Unknown.
• Enable authentication (password/ACLs) so RESTORE is not reachable before login.
• Restrict access to the Dragonfly port with firewalls to required application hosts only.
• Never expose the port to the internet.

Exploitation

• The vendor reports the issue was reproduced end to end on the stock container image v1.39.0.
• No evidence of active exploitation found; CISA SSVC lists exploitation as none and automatable as no.
• Public exploit code: not found.

Our recommendation

• Inventory all Dragonfly instances, including containers, Helm charts and test systems, and record their versions.
• Treat all versions below 1.40 as vulnerable until a patched release is confirmed.
• Enable authentication and block external and untrusted network access to the Dragonfly port now.
• Monitor the GitHub advisory GHSA-cg35-6jf4-crfh and update as soon as a patched release is published.
• Watch for unexpected crashes, restarts or new processes on Dragonfly hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fix commit 6c6b27a github.com
• Pull Request #7929 github.com
• GitHub Security Advisory GHSA-cg35-6jf4-crfh github.com
• OSV CVE-2026-104192 osv.dev
• Vulners MEND:CVE-2026-104192 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:57.