CVE-2025-59347 - CVE House

Back to Database

Status published Low CVE-2025-59347

Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

2.7 CVSS

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat jobs. An adversary performs a network-level Man-in-the-Middle attack, providing invalid data to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity problems. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59347

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →

Dragonfly tiny file download uses hard coded HTTP protocol

Dragonfly has weak integrity checks for downloaded files

Manager generates mTLS certificates for arbitrary IP addresses

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly

Vulnerable Versions:

< 2.1.0

Timeline

Official Publish: September 17th, 2025

Last Modified: September 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1040 Network Sniffing

T1552 Unsecured Credentials

Credential Access

T1071 Application Layer Protocol

Command and Control

T1565 Data Manipulation