Security Advisories
Vulnerabilities we’ve found and disclosed - the bug, the impact, and how we caught it, with proof.
Twice-Burned Hash: shallow listpack validation leaks heap memory in DragonflyDB
Dragonfly accepts malformed hash/zset listpacks over replication and RDB load that RESTORE rejects - crashing the server or leaking raw heap memory back to the client, unauthenticated, as the majority outcome of a single attempt.
DragonflyDB ≤ 2.0.0 (RDB loader + replication)/Minting vault shares for nothing
A price-inconsistent reserve check in Uniswap v3/v4 StandardExchange vaults lets an attacker mint shares for a deposit that never happened - flash-loanable and permissionless.
IndexedEx / Down To Finance - Uniswap v3 & v4 SE vaults/A fix isn't fixed until it ships
How we caught a patched, pre-auth SQL injection still live in ProFTPD's stable release - because the fix never got backported.
ProFTPD mod_sql - numeric %{n} log-tag (stable ≤ 1.3.8)/