CVE-2025-59410 - CVE House
Back to Database
Status published Medium CVE-2025-59410

Dragonfly tiny file download uses hard coded HTTP protocol

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59410

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →
CVE-2025-59354
Dragonfly has weak integrity checks for downloaded files
Medium 5.5
CVE-2025-59353
Manager generates mTLS certificates for arbitrary IP addresses
High 7.7
CVE-2025-59352
Dragonfly allows arbitrary file read and write on a peer machine
Medium 6.9
CVE-2025-59351
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Low 2.7
CVE-2025-59350
Timing attacks against Proxy’s basic authentication are possible
Low 2.7

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly
Vulnerable Versions:
< 2.1.0

Timeline

Official Publish: September 17th, 2025
Last Modified: September 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-311

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1040 Network Sniffing
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration
T1078 Valid Accounts
Persistence
T1530 Data from Cloud Storage
Collection