PT-2026-52863 · Dragonfly · Dragonfly
CVE-2026-47206
·
Published
2026-06-26
·
Updated
2026-06-26
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Dragonfly versions prior to 1.39.9
Description
An authenticated user can perform RESP Protocol Injection through the Lua
redis.error reply() function within the EvalSerializer. This allows the injection of arbitrary RESP messages into the connection response stream, which may lead to response desynchronization for clients using connection pools. RESP (Redis Serialization Protocol) is the communication protocol used by Redis and compatible data stores.Recommendations
Update to version 1.39.9.
Exploit
Fix
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dragonfly