What’s Vulnerable › Vulnerabilities

CVE-2025-26269

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-17 · updated 2026-06-17
• Weakness: CWE-191

Description

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.

Affected products

• dragonflydb dragonfly: before 1.29.0 — fixed in 1.29.0

How to fix

Upgrade to a fixed version: dragonflydb dragonfly 1.29.0. Check the vendor advisory for mitigations.

References

• https://gist.github.com/ankki-zsyang/d8215cf6e868d07546eaa5346a884ebd
• https://github.com/dragonflydb/dragonfly/commit/4612aec9a78e3f604e6fb19bee51acde89723308
• https://github.com/dragonflydb/dragonfly/issues/4468
• https://github.com/dragonflydb/dragonfly/issues/4468

Get alerted when CVE-2025-26269 or the next vulnerability affects your stack