Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dragonflydb/dragonfly

              main @ 1cadadf
            

Fixes

CVEs

CRITICAL

Peak severity

42.4%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

src/facade/dragonfly_connection.cc: most-fixed (4 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The ACL validator has suffered multiple severe logic flaws, including improper glob-matching boundaries in PUBLISH commands that allowed channel restriction bypasses, and missing command/subcommand translation logic. This allows users to execute restricted commands by abusing command aliases or subcommands.

Memory Corruption: Tiered list implementations (qlist.cc) assume memory presence during deletion and fail to properly manage pointer lifetimes. This has resulted in severe memory corruption, double-frees, and use-after-free bugs when listpack entries are compressed or freed without clearing references.

Sandbox Escape: The Lua execution sandbox has been bypassed by running arbitrary binary bytecode through the standard load() function and accessing globals via metatables, highlighting the need for strict execution mode parameters and environment overrides.