hyperadev/Dragonfly

hyperadev/Dragonfly

Releases1

Last Releaseover 3 years ago

Stars7

Java runtime dependency management library

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2025-26269NVD↗	< 1.29.0	Apr 17, 2025Thursday, 17 April 2025, 18:15	3.3 LOW	—
DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer.
CVE-2025-26268NVD↗	< 1.27.0	Apr 17, 2025Thursday, 17 April 2025, 18:15	3.3 LOW	—
DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the scan cursor was not checked.
CVE-2022-41967NVD↗	= 0.3.0-snapshot	Dec 28, 2022Wednesday, 28 December 2022, 00:15	7 HIGH	—
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.