CVE-2026-47206

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.

CVSS

No CVSS.

References

Link	Resource
https://github.com/dragonflydb/dragonfly/issues/7328
https://github.com/dragonflydb/dragonfly/pull/7332
https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h
https://github.com/dragonflydb/dragonfly/issues/7328

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Dragonfly es un almacén de datos en memoria diseñado para cargas de trabajo de aplicaciones modernas. Antes de la versión 1.39.9, Dragonfly presenta una Inyección de Protocolo RESP a través de Lua redis.error_reply() en EvalSerializer. Un usuario autenticado puede inyectar mensajes RESP arbitrarios en el flujo de respuesta de la conexión, lo que podría causar una desincronización de la respuesta en clientes de pool de conexiones. Esta vulnerabilidad se corrigió en la versión 1.39.9.

Information

Published : 2026-06-26 18:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-47206

Mitre link : CVE-2026-47206

CVE.ORG link : CVE-2026-47206

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-47206", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47206", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T17:31:44.526254Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dragonflydb", "product": "dragonfly", "versions": [{"status": "affected", "version": "< 1.38.9"}]}]}], "published": "2026-06-26T18:16:58.810", "references": [{"url": "https://github.com/dragonflydb/dragonfly/issues/7328", "source": "security-advisories@github.com"}, {"url": "https://github.com/dragonflydb/dragonfly/pull/7332", "source": "security-advisories@github.com"}, {"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h", "source": "security-advisories@github.com"}, {"url": "https://github.com/dragonflydb/dragonfly/issues/7328", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9."}, {"lang": "es", "value": "Dragonfly es un almac\u00e9n de datos en memoria dise\u00f1ado para cargas de trabajo de aplicaciones modernas. Antes de la versi\u00f3n 1.39.9, Dragonfly presenta una Inyecci\u00f3n de Protocolo RESP a trav\u00e9s de Lua redis.error_reply() en EvalSerializer. Un usuario autenticado puede inyectar mensajes RESP arbitrarios en el flujo de respuesta de la conexi\u00f3n, lo que podr\u00eda causar una desincronizaci\u00f3n de la respuesta en clientes de pool de conexiones. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.39.9."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}