PT-2025-17221 · Unknown · Dragonflydb Dragonfly

Kimdongyeon00 · Published 2025-04-17 · Updated 2025-07-11 · CVE-2025-26269

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DragonflyDB Dragonfly versions 1.28.2 and earlier

Description The issue allows authenticated users to cause a denial of service, resulting in a daemon crash, by utilizing a Lua library command that references a large negative integer.

Recommendations For DragonflyDB Dragonfly versions 1.28.2 and earlier, as a temporary workaround, consider restricting the use of Lua library commands that reference large negative integers until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2025-26269

Affected Products

Dragonflydb Dragonfly

References · 9

• 🔥 https://github.com/dragonflydb/dragonfly/issues/4468 · Exploit
• 🔥 https://gist.github.com/ankki-zsyang/d8215cf6e868d07546eaa5346a884ebd · Exploit
• https://github.com/dragonflydb/dragonfly/commit/4612aec9a78e3f604e6fb19bee51acde89723308 · Patch
• https://osv.dev/vulnerability/CVE-2025-26269 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26269 · Security Note
• https://t.me/cvedetector/23267 · Telegram Post
• https://t.me/cvenotify/128595 · Telegram Post
• https://t.me/cvetracker/21878 · Telegram Post
• https://twitter.com/CVEnew/status/1913455516094730525 · Twitter Post