What’s Vulnerable › Vulnerabilities

CVE-2026-47206: Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer

• Severity: low (CVSS 2.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-26 · updated 2026-10-25
• Weakness: CWE-116

Description

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer. An authenticated user can inject arbitrary RESP messages into the connection's response stream, potentially causing response desynchronization in connection-pool clients. This vulnerability is fixed in 1.39.9.

Affected products

• dragonflydb dragonfly: before 1.38.9

References

• https://github.com/dragonflydb/dragonfly/issues/7328
• https://github.com/dragonflydb/dragonfly/pull/7332
• https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-h77h-c6hc-qc9h
• https://github.com/dragonflydb/dragonfly/issues/7328

Get alerted when CVE-2026-47206 or the next vulnerability affects your stack