CVE-2025-59348 Dragonfly incorrectly handles a task structure’s usedTraffic field
Attackers can cause denial of service in Dragonfly peers by exploiting incorrect traffic accounting that bypasses rate limiting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59348?
CVE-2025-59348 is a medium-severity denial of service vulnerability in dragonflyoss dragonfly, published on 17 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.
Weakness: CWE-457
Which versions are affected by CVE-2025-59348?
6 open source packages ship an affected version, including github.com/dragonflyoss/dragonfly and d7y.io/dragonfly/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dragonflyoss/dragonfly Go | All versions | None |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
github.com/dragonflyoss/dragonfly Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
d7y.io/dragonfly/v2 Go | All versions | 2.1.0 |
Products include Linuxfoundation Dragonfly.
How do I fix CVE-2025-59348?
Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-59348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59348 exists.
Other vulnerabilities in dragonflyoss dragonfly
- CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key
- CVE-2026-24124 Dragonfly Manager Job API Allows Unauthenticated Access
- CVE-2025-59345 Dragonfly did not enable authentication for some Manager’s endpoints
- CVE-2025-59353 Manager generates mTLS certificates for arbitrary IP addresses
- CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine
Sources
Also known as GHSA-2qgr-gfvj-qpcr, GO-2025-3963.