Description
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
Scores
CVSS v3
3.3
EPSS
0.0011
EPSS Percentile
29.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-191
Status
published
Products (1)
dragonflydb/dragonfly
< 1.29.0
Published
Apr 17, 2025
Tracked Since
Feb 18, 2026