PT-2025-17214 · Unknown+1 · Dragonflydb+1

Ankki-Zsyang · Publicado 2025-04-17 · Atualizado 2025-04-19 · CVE-2025-26268

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DragonflyDB Dragonfly versions prior to 1.27.0

Description The issue allows authenticated users to cause a denial of service, resulting in a daemon crash, by sending a crafted Redis command. The problem stems from the lack of validation of the scan cursor's validity.

Recommendations For versions prior to 1.27.0, update to version 1.27.0 or later to resolve the issue. As a temporary workaround, consider restricting access to Redis commands to minimize the risk of exploitation.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-392

Identificadores relacionados

CVE-2025-26268

Produtos afetados

Dragonflydb

Redis

Referências · 8

• 🔥 https://github.com/dragonflydb/dragonfly/issues/4466 · Exploit
• https://github.com/dragonflydb/dragonfly/commit/d1fac0f912edb323a2bdd6404c518cda21eac243 · Correção
• https://github.com/dragonflydb/dragonfly/compare/v1.26.4...v1.27.0 · Correção
• https://t.me/cvetracker/21877 · Publicação no Telegram
• https://t.me/cvedetector/23273 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1913455515226546179 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-26268 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-26268 · Aviso do Fabricante