CVE-2026-62357

Dragonfly's CMS.INITBYDIM and CMS.INITBYPROB commands in src/core/cms.cc accept dimensions whose width × depth × sizeof(int64_t) overflows, allocating an undersized counter buffer. An unauthenticated remote client can then use CMS.INCRBY/CMS.QUERY with unbounded dimensions to corrupt or disclose ...