CVE-2025-59350 - CVE House
Back to Database
Status published Low CVE-2025-59350

Timing attacks against Proxy’s basic authentication are possible

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59350

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →
CVE-2025-59410
Dragonfly tiny file download uses hard coded HTTP protocol
Medium 5.5
CVE-2025-59354
Dragonfly has weak integrity checks for downloaded files
Medium 5.5
CVE-2025-59353
Manager generates mTLS certificates for arbitrary IP addresses
High 7.7
CVE-2025-59352
Dragonfly allows arbitrary file read and write on a peer machine
Medium 6.9
CVE-2025-59351
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Low 2.7

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly
Vulnerable Versions:
< 2.1.0

Timeline

Official Publish: September 17th, 2025
Last Modified: September 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-208

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.