CVE-2026-110912

🩸 CVE-2026-110912 — ARPBleed 🩸 ARP Packet Handling Vulnerability | DragonFly BSD | Security Research 🩸 Overview ARPBleed is the name associated with the reported vulnerability CVE-2026-110912, involving improper handling of Address Resolution Protocol ARP packet length fields in DragonFly BSD...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

Ruby Dragonfly <1.4.0 - Remote Code Execution

Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishand...

EUVD-2026-102470

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

DragonFly BSD 6.4.2 ARP Memory Disclosure

DragonFly BSD versions through 6.4.2 contain an out-of-bounds read in ARP packet handling. A proof of concept sends a malformed ARP request with oversized address-length fields and captures memory exposed in the response. https://packetstorm.news/download/236054...

CVE-2026-111279

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279

The Dragonfly database (through version 2.0.2 ) is vulnerable to an unbounded memory allocation issue. An unauthenticated client can exhaust system memory by providing a negative COUNT value to the HRANDFIELD , ZRANDMEMBER , or SRANDMEMBER commands. By sending a single command against a one-eleme...

Exploit for CVE-2026-110912

arpbleed arpbleed - CVE-2026-110912: remote unauthenticated k...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD (through 6.4.2 before 4bb22ff), the ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the ar_hln and ar_pln fields of incoming ARP packets. Consequently, in_arpreply() uses these attacker-controlled values as memcpy lengths when copying fro...

EUVD-2026-101819

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...