HIGHGo
GHSA-255v-qv84-29p5· CVE-2025-59353, GO-2025-3969DragonFly's manager generates mTLS certificates for arbitrary IP addresses
Modified: 9/26/2025
package
Go/d7y.io/dragonfly/v2
pkg:go/d7y.io/dragonfly/v2
MEDIUMGo
GHSA-2qgr-gfvj-qpcr· CVE-2025-59348, GO-2025-3963Dragonfly incorrectly handles a task structure’s usedTrac field
Modified: 9/26/2025
MEDIUMGo
GHSA-4mhv-8rh3-4ghw· CVE-2025-59351, GO-2025-3970DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error
Modified: 9/26/2025
LOWGo
GHSA-4q9j-6299-gxmr· CVE-2026-49254, GO-2026-5901Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Modified: 7/7/2026
MEDIUMGo
GHSA-79hx-3fp8-hj66· CVE-2025-59352, GO-2025-3971DragonFly vulnerable to arbitrary file read and write on a peer machine
Modified: 9/26/2025
LOWGo
GHSA-8425-8r2f-mrv6· CVE-2025-59349, GO-2025-3964Dragonfly's directories created via os.MkdirAll are not checked for permissions
Modified: 9/26/2025
HIGHGo
GHSA-89vc-vf32-ch59· CVE-2025-59345, GO-2025-3965Dragonfly doesn't have authentication enabled for some Manager’s endpoints
Modified: 9/26/2025
MEDIUMGo
GHSA-98x5-jw98-6c97· CVE-2025-59347, GO-2025-3966Dragonfly's manager makes requests to external endpoints with disabled TLS authentication
Modified: 9/26/2025
MEDIUMGo
GHSA-c2fc-9q9c-5486· CVE-2025-59350, GO-2025-3972Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
Modified: 9/26/2025
MEDIUMGo
GHSA-chwm-m7g7-685g· CVE-2026-54637, GO-2026-5910Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
Modified: 7/7/2026
HIGHGo
GHSA-g2rq-jv54-wcpr· CVE-2025-59346, GO-2025-3968Dragonfly vulnerable to server-side request forgery
Modified: 9/26/2025
CRITICAL9.8Go
GHSA-hpc8-7wpm-889w· CVE-2023-27584, GO-2024-3136Dragonfly2 has hard coded cyptographic key
Modified: 4/23/2025
MEDIUMGo
GHSA-hx2h-vjw2-8r54· CVE-2025-59354, GO-2025-3973DragonFly has weak integrity checks for downloaded files
Modified: 9/26/2025
HIGHGo
GHSA-j8hf-cp34-g4j7· CVE-2026-24124, GO-2026-4356Dragonfly Manager Job API Unauthenticated Access
Modified: 2/3/2026
LOW3.7Go
GHSA-mcvp-rpgg-9273· CVE-2025-59410, GO-2025-3974DragonFly's tiny file download uses hard coded HTTP protocol
Modified: 9/26/2025
—Go
GO-2024-3136· CVE-2023-27584, GHSA-hpc8-7wpm-889wDragonfly2 has hard coded cyptographic key in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3963· CVE-2025-59348, GHSA-2qgr-gfvj-qpcrDragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3964· CVE-2025-59349, GHSA-8425-8r2f-mrv6Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3965· CVE-2025-59345, GHSA-89vc-vf32-ch59Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3966· CVE-2025-59347, GHSA-98x5-jw98-6c97Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3968· CVE-2025-59346, GHSA-g2rq-jv54-wcprDragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3969· CVE-2025-59353, GHSA-255v-qv84-29p5DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3970· CVE-2025-59351, GHSA-4mhv-8rh3-4ghwDragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3971· CVE-2025-59352, GHSA-79hx-3fp8-hj66DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3972· CVE-2025-59350, GHSA-c2fc-9q9c-5486Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3973· CVE-2025-59354, GHSA-hx2h-vjw2-8r54DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3974· CVE-2025-59410, GHSA-mcvp-rpgg-9273DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2026-4356· CVE-2026-24124, GHSA-j8hf-cp34-g4j7Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2026-5901· CVE-2026-49254, GHSA-4q9j-6299-gxmrDragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth in d7y.io/dragonfly
Modified: 7/7/2026
—Go
GO-2026-5910· CVE-2026-54637, GHSA-chwm-m7g7-685gDragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile in d7y.io/dragonfly
Modified: 7/7/2026