Linuxfoundation Dragonfly vulnerabilities

13 CVEs affecting Linuxfoundation Dragonfly, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24124, published 2026-01-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-27584, published 2024-09-19. Critical severity, CVSS 9.8. EPSS: 33.9% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT…
CVE-2026-24124, published 2026-01-22. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and…
CVE-2025-59352, published 2025-09-17. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create…
CVE-2025-59345, published 2025-09-17. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without…
CVE-2025-59348, published 2025-09-17. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an…
CVE-2025-59350, published 2025-09-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is…
CVE-2025-59351, published 2025-09-17. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error.…
CVE-2025-59346, published 2025-09-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force…
CVE-2025-59353, published 2025-09-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the…
CVE-2025-59347, published 2025-09-17. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not…

Latest

CVE-2025-59410, published 2025-09-17. Low severity, CVSS 3.7. EPSS: 0.1% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol,…
CVE-2025-59354, published 2025-09-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files.…
CVE-2025-59349, published 2025-09-17. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access…