EUVD-2026-39810Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with low privilege required; high complexity because connection-pool multiplexing is a prerequisite; scope change affects pooled clients with low C and I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.
AnalysisAI
RESP protocol injection in Dragonfly's EvalSerializer allows an authenticated low-privilege user to embed raw CRLF sequences inside Lua redis.error_reply() and redis.status_reply() return values, causing response stream desynchronization for connection-pool clients. All Dragonfly releases prior to 1.39.9 are affected; the vulnerability is confirmed fixed in 1.39.9 per GitHub security advisory GHSA-h77h-c6hc-qc9h. No public exploit has been identified at time of analysis, and exploitation requires authenticated access plus a connection-pooling client architecture, substantially limiting real-world risk.
Technical ContextAI
Dragonfly is a Redis-compatible in-memory data store targeting modern cloud workloads (CPE: cpe:2.3:a:dragonflydb:dragonfly:*:*:*:*:*:*:*:*). The RESP (REdis Serialization Protocol) wire protocol uses CRLF (\r\n) sequences as frame delimiters - a structural property shared with HTTP/1.1 that makes it susceptible to injection if user-supplied strings are emitted verbatim into the response stream. The root cause is CWE-116 (Improper Encoding or Escaping of Output): the EvalSerializer class in src/server/main_service.cc forwarded strings returned by Lua redis.error_reply() and redis.status_reply() directly to the response buffer without sanitizing embedded CR or LF characters. Because RESP frames are delimited by \r\n, an attacker-controlled string containing those bytes is parsed by the receiving client as a complete, separate protocol message. The fix - confirmed in PR #7332 - introduces a StripCRLF() helper that iterates the string and discards \r and \n before serialization, and adds regression tests verifying that pipeline PING responses following an injected EVAL are not consumed by the injected frame.
RemediationAI
Upgrade Dragonfly to version 1.39.9 or later; this is the vendor-confirmed fix documented in GHSA-h77h-c6hc-qc9h and implemented in PR #7332 (https://github.com/dragonflydb/dragonfly/pull/7332). If an immediate upgrade is not feasible, operators can reduce exposure by restricting Lua EVAL command access to the minimum required set of trusted accounts using Dragonfly's ACL controls, preventing untrusted authenticated users from executing arbitrary scripts. As an additional layer, connection-pool clients can be configured to use dedicated (non-multiplexed) connections or to validate response framing, though this trades throughput for safety. Note that the StripCRLF sanitization introduced in 1.39.9 silently modifies strings containing \r or \n - callers relying on those characters in redis.error_reply() or redis.status_reply() return values will observe truncated output after upgrading.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today