CVE-2026-104192

Summary

This is a double-free vulnerability in Dragonfly's stream processing that can lead to allocator corruption and remote code execution when an unauthenticated client sends crafted stream data via RESTORE command. The flaw affects versions prior to 1.40.

Exploitability

Exploitation is relatively straightforward as it requires only sending a crafted serialized stream to the RESTORE command, with no authentication needed since the default configuration disables authentication.

Blast radius

The impact could be severe across all Dragonfly instances running in default configuration, potentially allowing attackers to execute arbitrary code as the service account with high privilege.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.40 or later immediately to remediate this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.