CVE-2026-54341: DragonflyDB Remote Denial of Service via Malformed RESTORE Command

Technical summary

CVE-2026-54341 is an out-of-bounds read vulnerability in DragonflyDB's listpack collection loader. When a malformed RESTORE payload is processed, the loader reads beyond allocated memory boundaries, triggering a SIGSEGV segmentation fault that terminates the server process. The RESTORE command is a standard keyspace operation that accepts user input in the default authentication-disabled configuration, making exploitation trivial. The vulnerability requires no special privileges, network access control bypass, or user interaction.

Business impact

Organizations running DragonflyDB in production face service disruption from a single malformed RESTORE command sent by any network-connected attacker. Unlike exploits requiring multi-step attack chains, this vulnerability enables immediate downtime with minimal attacker effort. Repeated exploitation can create a denial-of-service loop, degrading application availability and SLA compliance. The risk is particularly acute for deployments exposed to untrusted networks or where DragonflyDB is internet-facing.

Affected systems

DragonflyDB versions prior to 1.39.0 are affected. The vulnerability does not target specific operating systems or architectures—it manifests at the application logic layer during RESTORE payload parsing. Any deployment running an affected version is vulnerable if the RESTORE command is accessible, which includes default configurations where authentication is not enabled.

Exploitability

Exploitability is very high. No authentication is required, no user interaction is needed, and the attack payload is minimal (~24 bytes). An attacker can craft and send the malicious RESTORE command over the network using standard DragonflyDB clients or raw TCP. The crash is immediate and deterministic, making this a repeatable denial-of-service primitive. No advanced exploitation knowledge or tool chains are necessary.

Remediation

Upgrade to DragonflyDB version 1.39.0 or later, which patches the out-of-bounds read in the listpack loader. Additionally, implement network-level access controls to restrict RESTORE command availability to trusted clients. Enable DragonflyDB's authentication mechanisms (if available in your version) to require credentials for keyspace operations. For environments unable to patch immediately, restrict network access to the DragonflyDB port using firewalls or security groups.

Patch guidance

Apply DragonflyDB 1.39.0 or later as a priority. Verify the upgrade by checking version output (e.g., via INFO command) and testing that RESTORE commands function correctly with legitimate payloads. If running in a containerized environment, ensure your image build includes the patched version. Test the patch in a staging environment first to validate compatibility with your application stack, though this is primarily a security fix with no expected functional changes.

Detection guidance

Monitor DragonflyDB logs and system metrics for unexpected server crashes (SIGSEGV signals or abnormal process termination). Network-level detection can identify repeated RESTORE commands with unusually small payloads or malformed structures. Implement alerting on DragonflyDB process restarts or high-frequency connection drops, which may indicate exploitation attempts. If you lack direct visibility into DragonflyDB traffic, monitor application-level symptoms such as sudden loss of cache functionality or backend service failures. Correlate timing with any suspicious network activity or user reports of service unavailability.

Why prioritize this

This vulnerability merits immediate patching despite not being on the CISA KEV catalog. The combination of zero authentication requirements, remote network access, trivial payload size, and guaranteed denial-of-service impact creates an exceptionally low-friction attack path. Any DragonflyDB instance exposed to untrusted networks is at critical risk. Prioritize patching based on whether your deployment is internet-facing or accessible from broader internal networks; instances behind strict network boundaries can be addressed in a standard maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects network-based remote access, no authentication requirement, low attack complexity, and complete availability impact. The score does not account for the trivial 24-byte payload or the repeatability of the crash, which in operational reality make this more disruptive than the numeric score alone suggests. The absence of a confidentiality or integrity impact keeps the score from critical range, but the ease of exploitation and operational consequence justify treating this as a priority-one patch target.

Frequently asked questions