CVE-2026-62357 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
An integer overflow in DragonflyDB allows remote attackers to trigger heap out-of-bounds writes, potentially leading to code execution or server crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62357?
CVE-2026-62357 is a high-severity vulnerability in dragonflydb dragonfly, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.
Weakness: CWE-190
Which versions are affected by CVE-2026-62357?
How do I fix CVE-2026-62357?
No fix has been published for CVE-2026-62357 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62357 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62357 exists.
Sources
Also known as GHSA-cmmv-h748-v93x.