CVE-2026-104192 DragonflyDB stream RDB deserialization double-free
Unauthenticated attackers can trigger a double-free in DragonflyDB via crafted stream data, causing denial of service or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104192?
CVE-2026-104192 is a critical use after free vulnerability in dragonflydb dragonfly, published on 13 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Weakness: CWE-415
Which versions are affected by CVE-2026-104192?
How do I fix CVE-2026-104192?
No fix has been published for CVE-2026-104192 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-104192 being exploited?
There is no known exploitation of CVE-2026-104192 in the wild and no public exploit code.
Sources
Also known as GHSA-cg35-6jf4-crfh.