CVE-2026-62357

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 1.40.0

Description An integer overflow occurs in src/core/cms.cc when the CMS.INITBYDIM and CMS.INITBYPROB endpoints accept dimensions where the product of width, depth, and sizeof(int64 t) exceeds the maximum representable value. This results in the allocation of an undersized counter buffer. Subsequently, the CMS.INCRBY and CMS.QUERY endpoints use the original unbounded dimensions, enabling an unauthenticated remote client to crash the server or corrupt and disclose adjacent heap memory.

Recommendations Update to version 1.40.0.