dragonfly
v2.1A modern replacement for Redis and Memcached
- Maintenance
- Active427 commits in 3 months · bus factor 3
- License
- BUSL-1.1Source-available · not OSI-approved
- Security
- 7 advisories5 medium, 2 low · Scorecard 5.3/10
- Supported versions
- No scheduleendoflife.date does not track this project
31.9k stars · 1.3k forks · 218 open issues · last release 10 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 7 most recent advisories published by the maintainers: 5 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-pmgx-g74v-v37gSep 23, 2026Malformed hash/zset listpack in an RDB image crashes the server and can leak heap memory
- Affected
- <=2.0.0
- mediumCVE-2026-104192Sep 20, 2026DragonflyDB stream RDB deserialization double-free (CWE-415)
- Affected
- < 1.40
- lowGHSA-f4g8-vhw4-36xmSep 20, 2026Unauthenticated remote code execution in DragonflyDB (stack buffer overflow in `CompactObj::HashCode()`)
- Affected
- <= 1.40
- mediumGHSA-9q98-cx72-pg45Sep 20, 2026Unauthenticated remote code execution in DragonflyDB (memcached reply-builder heap overflow)
- Affected
- < 1.40.1
- mediumCVE-2026-62357Jul 15, 2026DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write
- Affected
- < 1.40
- mediumCVE-2026-54341Jun 15, 2026RESTORE operations may crash the server
- Affected
- < 1.39
- lowCVE-2026-47206May 19, 2026RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer
- Affected
- < 1.38.9