CVE-2025-59348 - CVE House
Back to Database
Status published Medium CVE-2025-59348

Dragonfly incorrectly handles a task structure’s usedTraffic field

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59348

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →
CVE-2025-59410
Dragonfly tiny file download uses hard coded HTTP protocol
Medium 5.5
CVE-2025-59354
Dragonfly has weak integrity checks for downloaded files
Medium 5.5
CVE-2025-59353
Manager generates mTLS certificates for arbitrary IP addresses
High 7.7
CVE-2025-59352
Dragonfly allows arbitrary file read and write on a peer machine
Medium 6.9
CVE-2025-59351
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Low 2.7

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly
Vulnerable Versions:
< 2.1.0

Timeline

Official Publish: September 17th, 2025
Last Modified: September 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-457

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.