CVE-2025-59350
Medium
Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0.
SeverityMedium
CVSS5.3
Exploit probability—
ProductLinuxfoundation Dragonfly
PublishedSep 17, 2025
First seenSep 17, 2025
Weakness typeCWE-208CWE-208
How to fix
Update
- linuxfoundation dragonfly2.1.0 or later
- github.com/dragonflyoss/dragonfly2.1.0 or later
- d7y.io/dragonfly/v22.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation dragonfly | v < 2.1.0 | 2.1.0 |
| github.com/dragonflyoss/dragonflyGo | v < 2.1.0, No range specified | 2.1.0 |
| d7y.io/dragonfly/v2Go | v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.