What is the CVSS score of CVE-2026-54341?

CVE-2026-54341 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of DragonflyDB are affected by CVE-2026-54341?

DragonflyDB in-memory database installations are vulnerable to unauthenticated remote denial of service, allowing any network-adjacent attacker to crash the entire server using a trivial 24-byte…. A patch is available.

How to fix or mitigate CVE-2026-54341?

Within 24 hours: identify all DragonflyDB instances in production environments and document current versions. Within 7 days: upgrade all instances to DragonflyDB 1.39.0 or later; if immediate patching is not feasible, restrict network access to the DragonflyDB port to trusted clients only. Within 30 days: complete validation that all systems are on patched versions and conduct availability testing.

DragonflyDB CVE-2026-54341

EUVD-2026-39811 HIGH

Out-of-bounds Read (CWE-125)

2026-06-26 GitHub_M

Denial Of Service Buffer Overflow Information Disclosure Dragonfly

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Default no-auth network exposure gives AV:N/AC:L/PR:N/UI:N; single command crashes the whole process for A:H, with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 19:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 17:52 vuln.today

Analysis Generated

Jun 26, 2026 - 17:52 vuln.today

DescriptionCVE.org

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server with a single ~24-byte command - a remote, repeatable denial of service. This vulnerability is fixed in 1.39.0.

AnalysisAI

Remote denial of service in DragonflyDB before 1.39.0 lets an unauthenticated attacker crash the entire server with a single ~24-byte RESTORE command carrying a malformed listpack payload, triggering an out-of-bounds read (SIGSEGV). Because Dragonfly ships with no authentication enabled by default and RESTORE is an ordinary keyspace command, any client that can reach the port can repeatedly kill the process. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach unauthenticated Dragonfly port

Delivery

Send crafted RESTORE listpack payload

Exploit

Pass shallow listpack header validation

Execution

Trigger out-of-bounds read in loader

Persist

Crash server process (SIGSEGV)

Impact

Repeat to sustain denial of service

Access

Reach unauthenticated Dragonfly port

Delivery

Send crafted RESTORE listpack payload

Exploit

Pass shallow listpack header validation

Execution

Trigger out-of-bounds read in loader

Persist

Crash server process (SIGSEGV)

Impact

Repeat to sustain denial of service

Vulnerability AssessmentAI

Exploitation	The attacker needs network reachability to the DragonflyDB port and the ability to send a RESTORE command - both satisfied by default, since Dragonfly requires no authentication out of the box and RESTORE is a standard keyspace command (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals point to a genuine, easy-to-trigger availability threat rather than a paper-tiger high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach an internet-exposed or shared-network DragonflyDB instance (which by default requires no authentication) opens a connection and issues a single RESTORE command with a crafted listpack-encoded payload whose interior string entry declares a length of 0x7fffffff. The server's shallow listpack validation passes the header, then reads out of bounds and dies with SIGSEGV, dropping all clients; the attacker simply re-sends the command after each restart for a sustained outage. …
Remediation	Vendor-released patch: upgrade to DragonflyDB 1.39.0 or later, which enforces deep listpack integrity validation on RESTORE payloads. … Detailed patch versions, workarounds, and compensating controls in full report.