HIGHGo
GHSA-255v-qv84-29p5· CVE-2025-59353, GO-2025-3969DragonFly's manager generates mTLS certificates for arbitrary IP addresses
Modified: 9/26/2025
package
Go/github.com/dragonflyoss/dragonfly
pkg:go/github.com/dragonflyoss/dragonfly
MEDIUMGo
GHSA-2qgr-gfvj-qpcr· CVE-2025-59348, GO-2025-3963Dragonfly incorrectly handles a task structure’s usedTrac field
Modified: 9/26/2025
MEDIUMGo
GHSA-4mhv-8rh3-4ghw· CVE-2025-59351, GO-2025-3970DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error
Modified: 9/26/2025
MEDIUMGo
GHSA-79hx-3fp8-hj66· CVE-2025-59352, GO-2025-3971DragonFly vulnerable to arbitrary file read and write on a peer machine
Modified: 9/26/2025
LOWGo
GHSA-8425-8r2f-mrv6· CVE-2025-59349, GO-2025-3964Dragonfly's directories created via os.MkdirAll are not checked for permissions
Modified: 9/26/2025
HIGHGo
GHSA-89vc-vf32-ch59· CVE-2025-59345, GO-2025-3965Dragonfly doesn't have authentication enabled for some Manager’s endpoints
Modified: 9/26/2025
MEDIUMGo
GHSA-98x5-jw98-6c97· CVE-2025-59347, GO-2025-3966Dragonfly's manager makes requests to external endpoints with disabled TLS authentication
Modified: 9/26/2025
MEDIUMGo
GHSA-c2fc-9q9c-5486· CVE-2025-59350, GO-2025-3972Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
Modified: 9/26/2025
HIGHGo
GHSA-g2rq-jv54-wcpr· CVE-2025-59346, GO-2025-3968Dragonfly vulnerable to server-side request forgery
Modified: 9/26/2025
MEDIUMGo
GHSA-hx2h-vjw2-8r54· CVE-2025-59354, GO-2025-3973DragonFly has weak integrity checks for downloaded files
Modified: 9/26/2025
LOW3.7Go
GHSA-mcvp-rpgg-9273· CVE-2025-59410, GO-2025-3974DragonFly's tiny file download uses hard coded HTTP protocol
Modified: 9/26/2025
—Go
GO-2025-3963· CVE-2025-59348, GHSA-2qgr-gfvj-qpcrDragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3964· CVE-2025-59349, GHSA-8425-8r2f-mrv6Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3965· CVE-2025-59345, GHSA-89vc-vf32-ch59Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3966· CVE-2025-59347, GHSA-98x5-jw98-6c97Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3968· CVE-2025-59346, GHSA-g2rq-jv54-wcprDragonfly vulnerable to server-side request forgery in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3969· CVE-2025-59353, GHSA-255v-qv84-29p5DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3970· CVE-2025-59351, GHSA-4mhv-8rh3-4ghwDragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3971· CVE-2025-59352, GHSA-79hx-3fp8-hj66DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3972· CVE-2025-59350, GHSA-c2fc-9q9c-5486Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3973· CVE-2025-59354, GHSA-hx2h-vjw2-8r54DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly
Modified: 3/3/2026
—Go
GO-2025-3974· CVE-2025-59410, GHSA-mcvp-rpgg-9273DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
Modified: 3/3/2026