Skip to main content

Dragonfly CVE-2025-59354

MEDIUM
Use of Weak Hash (CWE-328)
2025-09-17 security-advisories@github.com
Information Disclosure Dragonfly Suse
5.5
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:12 vuln.today
Patch released
Mar 28, 2026 - 19:12 nvd
Patch available
CVE Published
Sep 17, 2025 - 20:15 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.

AnalysisAI

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-328. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0. Affected products include: Linuxfoundation Dragonfly. Version information: Prior to 2.1.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Dragonfly

View all
CVE-2026-24124 CRITICAL POC
9.8 Jan 22

Dragonfly P2P file distribution system versions 2.4.1-rc.0 and below have a missing authentication vulnerability allowin
CVE-2021-33564 CRITICAL POC
9.8 May 29

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write
CVE-2025-59353 HIGH POC
7.7 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated high severity (CVSS 7.7), t
CVE-2025-59345 HIGH
7.7 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated high severity (CVSS 7.7), t
CVE-2026-54341 HIGH
7.5 Jun 26

Remote denial of service in DragonflyDB before 1.39.0 lets an unauthenticated attacker crash the entire server with a si
CVE-2022-41967 HIGH
7.5 Dec 28

Dragonfly is a Java runtime dependency management library. Rated high severity (CVSS 7.5), this vulnerability is remotel
CVE-2025-26268 LOW POC
3.3 Apr 17

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted
CVE-2025-26269 LOW POC
3.3 Apr 17

DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon c
CVE-2025-59410 MEDIUM
5.5 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 5.5),
CVE-2026-47206 LOW
2.3 Jun 26

RESP protocol injection in Dragonfly's EvalSerializer allows an authenticated low-privilege user to embed raw CRLF seque
CVE-2025-59352 MEDIUM
6.9 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated medium severity (CVSS 6.9),
CVE-2025-59351 LOW
2.7 Sep 17

Dragonfly is an open source P2P-based file distribution and image acceleration system. Rated low severity (CVSS 2.7), th

Same weakness CWE-328 – Use of Weak Hash

View all
CVE-2020-37168 CRITICAL POC
9.3
CVE-2023-46133 CRITICAL POC
9.1
CVE-2023-2900 HIGH POC
7.5
CVE-2024-47829 MEDIUM POC
6.5
CVE-2022-3433 MEDIUM POC
6.5
CVE-2025-27595 CRITICAL
9.8
CVE-2026-36182 CRITICAL
9.8
CVE-2024-54143 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed

Share

CVE-2025-59354 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy