Dragonfly DB Double-Free Flaw Risks Remote Code Execution for Pre-1.40 Users

Organizations running Dragonfly DB versions prior to 1.40 face immediate risk from a critical remote code execution flaw. According to the National Vulnerability Database record for CVE-2026-104192, the vulnerability carries a CVSS score of 9.6. The issue stems from a double-free memory error within the OpaqueObjLoader::CreateStream function located in the src/server/rdb_load.cc file. This flaw allows an attacker to corrupt memory and potentially execute arbitrary code as the service account.

How it unfolded

• Researchers identified that the OpaqueObjLoader associates a streamNACK with both global and consumer-local pending entry lists.
• When a duplicate consumer entry is rejected, the system frees the shared object prematurely.
• Subsequent cleanup routines attempt to free the same object again, causing a double-free condition that corrupts the allocator.

Who is affected

Dragonfly is an in-memory data store designed for modern application workloads. The vulnerability affects all installations using versions prior to 1.40. The National Vulnerability Database notes that the default configuration for Dragonfly ships with authentication disabled. This default setting means that any unauthenticated client can reach the vulnerable RESTORE command. An attacker does not need valid credentials to send the crafted serialized stream required to trigger the exploit.

Our take on the response

The vendor has identified the source code fix for the double-free error in the RDB loading process. However, this correction has not yet been mapped to a published release version. Organizations are currently operating without an official binary patch. The absence of a downloadable update means that administrators cannot simply apply a standard software update to resolve the issue. Until a new version is released, the exposure remains unmitigated at the software level.

Who needs to act first

Managed service providers should immediately inventory all client environments running Dragonfly DB. Prioritize systems exposed to public networks or those without mandatory authentication. Since no patch exists, focus on reducing the attack surface. Ensure that authentication is enabled on all instances, even if it was disabled by default. Restrict network access to the service port using firewalls or security groups. Monitor logs for unusual RESTORE command activity. Communicate with clients about the lack of a vendor fix and the need for manual mitigation measures.

What to do and how to stay safe: Dragonfly DB

• Enable authentication on all Dragonfly DB instances to prevent unauthenticated access to the RESTORE command.
• Restrict network access to Dragonfly DB ports to trusted IP addresses only using firewall rules or security groups.
• Monitor application logs for any unexpected or large data restoration attempts that could indicate exploitation.
• Prepare to upgrade to version 1.40 or later as soon as the vendor releases a stable, patched build.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104192?

The vulnerability has a CVSS score of 9.6, which is rated as critical.

Which versions of Dragonfly DB are vulnerable?

All versions of Dragonfly DB prior to 1.40 are affected by this double-free flaw.

Is there a patch available for this vulnerability?

No, the source fix has not yet been mapped to a published release, so no patch is currently available.