CVE-2025-26269

Description

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.

Reserved 2025-02-07 | Published 2025-04-17 | Updated 2025-04-23 | Assigner mitre

Problem types

CWE-191 Integer Underflow (Wrap or Wraparound)

Product status

Default status
unknown

Any version
affected

References

github.com/dragonflydb/dragonfly/issues/4468

github.com/...ommit/4612aec9a78e3f604e6fb19bee51acde89723308

gist.github.com/...i-zsyang/d8215cf6e868d07546eaa5346a884ebd

cve.org (CVE-2025-26269)

nvd.nist.gov (CVE-2025-26269)

Download JSON