High severityNVD Advisory· Published Aug 18, 2026

CVE-2026-62357

Description

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dragonflydb/Dragonflyllm-fuzzy
Range: <1.40.0

Patches

Vulnerability mechanics

References

github.com/dragonflydb/dragonfly/commit/c004623249fe2151dc5d64e21364fb9fb07c90d3nvd
github.com/dragonflydb/dragonfly/pull/7647nvd
github.com/dragonflydb/dragonfly/releases/tag/v1.40.0nvd
github.com/dragonflydb/dragonfly/security/advisories/GHSA-cmmv-h748-v93xnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000