{"schema":"threatline.record/2","record":{"id":"CVE-2026-111279","aliases":[],"summary":"Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER","details":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.","categories":["Unclassified"],"product":"dragonfly","vendor":"dragonflydb","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111279","source_modified_at":"2026-10-16T19:43:45.103Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"dragonfly","vendor":"dragonflydb","versions":[{"version":"0","status":"affected","versionType":"semver","lessThanOrEqual":"2.0.2"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00485,"percentile":0.40834,"score_date":"2026-10-23"},"published_at":"2026-10-15T21:43:23.862Z","modified_at":"2026-10-16T19:43:45.103Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111279","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T19:43:45.103Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111279","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/dragonflydb/dragonfly/issues/8578","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/hset_family.cc#L1436-L1483","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/zset_family.cc#L1519-L1522","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dragonflydb/dragonfly/blob/8ce4bbb106586057fbd85f71ed353c60d0d5bf87/src/server/set_family.cc#L957-L984","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/dragonflydb/dragonfly","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/dragonfly-through-2.0.2-unbounded-memory-allocation-via-negative-count-in-hrandfield-zrandmember-and-srandmember","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T19:43:16.935776Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T19:43:45.103Z","content_hash":"890bd349e64b328590df1b7964cf4f7f2d09eab971617de791a12c5105762d0c"}}