{"metadata": {"vulnerability": "cve-2026-104192", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-01T18:54:15.119Z", "date_only": false, "value": "2026-10-01T18:54:15.119Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-104192", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T14:42:54.248Z", "date_only": false, "value": "2026-10-13T14:42:54.248Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-104192", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T14:42:54.248Z", "date_only": false, "value": "2026-10-13T14:42:54.248Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-104192", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:00:56.043Z", "date_only": false, "value": "2026-10-13T15:00:56.043787Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117434197961595011", "record": "CVE-2026-104192", "field": "creation_timestamp", "uuid": "674dba0c-583e-4a1a-9adb-dad5d4f50565", "content": "CVE-2026-104192 DragonflyDB stream RDB deserialization double-free Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104192https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfhhttps://github.com/dragonflydb/dragonfly/pull/7929https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e#dragonflydb #dragonfly#CVE_2026_104192#bot", "url": "https://infosec.exchange/users/cve/statuses/117434197961595011"}, {"timestamp": "2026-10-13T15:17:31.087Z", "date_only": false, "value": "2026-10-13T15:17:31.087", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104192", "record": "FKIE_CVE-2026-104192", "field": "published"}, {"timestamp": "2026-10-13T15:25:47.878Z", "date_only": false, "value": "2026-10-13T15:25:47.878490Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-104192", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T15:25:47.878Z", "date_only": false, "value": "2026-10-13T15:25:47.878490Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104192", "record": "FKIE_CVE-2026-104192", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T15:26:00.663Z", "date_only": false, "value": "2026-10-13T15:26:00.663Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-104192", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:26:00.663Z", "date_only": false, "value": "2026-10-13T15:26:00.663Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-104192", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:40:04.480Z", "date_only": false, "value": "2026-10-13T15:40:04.480248Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxrekh5ydq22", "record": "CVE-2026-104192", "field": "creation_timestamp", "uuid": "b77c6585-a7e8-43f3-bf2d-f9e510b77898", "content": "CVE-2026-104192 - dragonfly\nThe in\u2011memory database DragonflyDB (versions before 1.40) can be tricked into freeing the same memory area twice. An attacker without a login can send a specially crafted\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#dragonfly #dragonflydb #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxrekh5ydq22"}, {"timestamp": "2026-10-13T16:08:26.574Z", "date_only": false, "value": "2026-10-13T16:08:26.574670Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrg56ls3p24", "record": "CVE-2026-104192", "field": "creation_timestamp", "uuid": "a5eb5d95-322b-48a9-9020-b8b53fb58fe8", "content": "\ud83d\udea8 CVE-2026-104192 \u2014 CVSS 9.6 CRITICAL\n\nDragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104192\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxrg56ls3p24"}, {"timestamp": "2026-10-13T16:17:11.333Z", "date_only": false, "value": "2026-10-13T16:17:11.333", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104192", "record": "FKIE_CVE-2026-104192", "field": "lastModified"}]}