Dragonfly: Unbounded memory allocation via negative COUNT in random member commands

Summary

Dragonfly through version 2.0.2 allows unauthenticated clients to trigger an unbounded memory allocation by sending HRANDFIELD, ZRANDMEMBER or SRANDMEMBER with a large negative COUNT value. A single command can exhaust host memory, causing the operating system's OOM killer to terminate the Dragonfly instance and disconnect all of its clients. The vulnerability affects availability only, and exposure depends on whether the instance is reachable from untrusted networks.

Affected

• Dragonfly through version 2.0.2 (dragonflydb/dragonfly), per the CVE record
• Vendor-confirmed fixed version: Unknown.

Fixed in

• Unknown. No vendor advisory or release names a fixed version for this CVE.
• A proposed fix (PR #8653) adds a --max_rand_count limit; its merge status is unknown.
• Upgrading to 2.0.2 does not fix this issue, because 2.0.2 is within the affected range.

Workaround

• Do not expose Dragonfly ports to untrusted networks or the internet; restrict access with firewall rules or Kubernetes NetworkPolicies.
• Enforce authentication for all clients so that the unauthenticated attack path is closed.
• Run the instance with a memory limit and automatic restart to limit the impact of an OOM kill (restarts do not prevent the crash).
• Note: these are recommendations, not vendor guidance.

Exploitation

• Public technical details are available (GitHub issue #8578).
• Exploitation is simple once the service port is reachable: a single command is sufficient.
• No evidence of exploitation in the wild was found; the CVE is not listed in CISA KEV as far as known.
• CISA SSVC: exploitation status poc, automatable yes, technical impact partial.

Our recommendation

• Inventory all Dragonfly instances, including those hidden behind Redis-compatible connection strings.
• Remove any direct exposure to untrusted networks and enforce authentication.
• Apply memory limits and automatic restart, and monitor for unexpected restarts and OOM events.
• Track the upstream fix and re-check NVD and vendor status, as the NVD status is Deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub issue #8578 (technical description) github.com
• Fix PR #8653 github.com
• VulnCheck advisory www.vulncheck.com
• VulDB entry vuldb.com
• Dragonfly releases github.com
• NixOS tracker github.com
• Vulnrichment affected range (OffSeq Radar) radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:25.