What is the CVSS score of CVE-2025-26269?

CVE-2025-26269 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Dragonfly are affected by CVE-2025-26269?

CVE-2025-26269 is a low-severity vulnerability (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2025-26269?

Yes, a public proof-of-concept exploit is available for CVE-2025-26269. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-26269?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Dragonfly CVE-2025-26269

LOW

Integer Underflow (CWE-191)

2025-04-17 cve@mitre.org

Integer Overflow Denial Of Service Dragonfly

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:37 vuln.today

Patch released

Mar 28, 2026 - 18:37 nvd

Patch available

PoC Detected

Jul 11, 2025 - 16:36 vuln.today

Public exploit code

CVE Published

Apr 17, 2025 - 18:15 nvd

LOW 3.3

DescriptionCVE.org

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.

AnalysisAI

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-191. DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer. Affected products include: Dragonflydb Dragonfly. Version information: through 1.28.2.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2025-26269 vulnerability details – vuln.today

Back

Dragonfly CVE-2025-26269

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code