DragonflyDB CVE-2026-111279

Exploitation requires network access to the Dragonfly service and an existing key of the matching type (a hash for HRANDFIELD, a sorted set for ZRANDMEMBER, or a set for SRANDMEMBER) holding at least one element; the attacker then supplies a large negative COUNT argument, which the vulnerable code paths allocate without bounds. No authentication is required per the CVSS vector (PR:N), so instances reachable without the optional requirepass/ACL protection or network segmentation are directly exposed. Limiting factors: the attacker must be able to reach the Dragonfly port and a qualifying key must exist (or be creatable); deployments that bind Dragonfly to localhost, enforce authentication, or firewall the datastore port substantially reduce realistic exploitability. Impact is confined to availability - crashing the instance - with no data exposure or modification.

This is a genuine availability-focused denial-of-service issue, not a high-CVSS-but-low-risk theoretical finding, but its impact is bounded to availability only. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity impact. The base score of 8.7 is driven entirely by the trivial remote-unauthenticated path to a full instance crash. Mitigating the urgency: there is NO CISA KEV listing and NO explicitly flagged public exploit code in the provided intelligence, so the real-world exploitation signal is currently low despite the high severity - EPSS and SSVC data were not supplied and cannot be factored in. The attack destroys availability for ALL clients of the instance (OOM-kills the whole process), which raises operational risk for anyone exposing Dragonfly without network controls or authentication. Note a metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts the description and the CVSS vector (VC:N) - this is purely an availability/DoS flaw (CWE-789, unbounded memory allocation), so the Information Disclosure classification should be disregarded.

An attacker with network reachability to a Dragonfly instance (default port 6379) that lacks authentication issues a single command such as SRANDMEMBER mykey -9999999999 against a key holding even one element; because a negative COUNT permits duplicate selection, Dragonfly attempts to allocate a result set of that enormous size. The allocation exhausts host memory and triggers the Linux OOM killer, terminating the Dragonfly process and denying service to every connected client. No public exploit code is identified in the provided data, but the triggering command is trivial to reproduce from the public vulnerability description.