CVE-2026-62357

The record

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the unbounded dimensions, which allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server. This issue is fixed in version 1.40.0.

Affected packages

Related vulnerabilities

• CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before… CWE-190
• CVE-2026-53615 util-linux is a random collection of Linux utilities. CWE-190
• CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-190
• CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add()… CWE-190
• CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. CWE-190
• CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. CWE-190
• CVE-2026-102633 libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in… CWE-190