CVE-2025-59350
published 2025-09-17CVE-2025-59350: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.32%
23.2th percentile
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| d7y.io | dragonfly_v2 | >= 0 < 2.1.0 | 2.1.0 |
| dragonflyoss | dragonfly | < 2.1.0 | 2.1.0 |
| github.com | dragonflyoss_dragonfly | >= 0 < 2.1.0 | 2.1.0 |
| linuxfoundation | dragonfly | < 2.1.0 | 2.1.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
osv·2025-09-24
CVE-2025-59350 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
GHSA
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
ghsa·2025-09-17
CVE-2025-59350 [MEDIUM] CWE-208 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
### Impact
The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times.
The vulnerability is shown in figure 8.1, where both the username and password are compared with a short-circuiting equality operation.
```golang
if user != proxy.basicAuth.Username || pass != proxy.basicAuth.Password {
```
It is currently undetermined what an attacker may be able to do with access to the proxy password.
### Patches
- Dragonfy v2.1.0 and above.
### Workarounds
There are
OSV
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
osv·2025-09-17
CVE-2025-59350 [MEDIUM] Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
### Impact
The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times.
The vulnerability is shown in figure 8.1, where both the username and password are compared with a short-circuiting equality operation.
```golang
if user != proxy.basicAuth.Username || pass != proxy.basicAuth.Password {
```
It is currently undetermined what an attacker may be able to do with access to the proxy password.
### Patches
- Dragonfy v2.1.0 and above.
### Workarounds
There are
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-17
Published