Skip to main content

Dragonfly CVE-2025-59351

LOW
NULL Pointer Dereference (CWE-476)
2025-09-17 security-advisories@github.com
Denial Of Service Null Pointer Dereference Dragonfly
2.7
CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY
2.7 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:12 vuln.today
Patch released
Mar 28, 2026 - 19:12 nvd
Patch available
CVE Published
Sep 17, 2025 - 20:15 nvd
LOW 2.7

DescriptionGitHub Advisory

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0.

AnalysisAI

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.

Technical ContextAI

This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0. Affected products include: Linuxfoundation Dragonfly. Version information: Prior to 2.1.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.

More in Dragonfly

View all
CVE-2026-24124 CRITICAL POC
9.8 Jan 22

Dragonfly P2P file distribution system versions 2.4.1-rc.0 and below have a missing authentication vulnerability allowin
CVE-2021-33564 CRITICAL POC
9.8 May 29

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write
CVE-2025-59353 HIGH POC
7.7 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated high severity (CVSS 7.7), t
CVE-2025-59345 HIGH
7.7 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated high severity (CVSS 7.7), t
CVE-2026-54341 HIGH
7.5 Jun 26

Remote denial of service in DragonflyDB before 1.39.0 lets an unauthenticated attacker crash the entire server with a si
CVE-2022-41967 HIGH
7.5 Dec 28

Dragonfly is a Java runtime dependency management library. Rated high severity (CVSS 7.5), this vulnerability is remotel
CVE-2025-26268 LOW POC
3.3 Apr 17

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted
CVE-2025-26269 LOW POC
3.3 Apr 17

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon c
CVE-2025-59410 MEDIUM
5.5 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 5.5),
CVE-2026-47206 LOW
2.3 Jun 26

RESP protocol injection in Dragonfly's EvalSerializer allows an authenticated low-privilege user to embed raw CRLF seque
CVE-2025-59354 MEDIUM
5.5 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 5.5),
CVE-2025-59352 MEDIUM
6.9 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 6.9),

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2025-59351 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy