Vulnerabilities

TI-2026-19442 CVE-2026-24124 · GHSA-j8hf-cp34-g4j7

Dragonfly Manager Job API Allows Unauthenticated Access

MEDIUM 48

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00782 Published 2026-01-22 Fixed in 2.4.1-rc.1, 2.4.1 CWE-306

TI-2025-36963 CVE-2025-59410 · GHSA-mcvp-rpgg-9273

Dragonfly tiny file download uses hard coded HTTP protocol

LOW 30

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00139 Published 2025-09-17 Fixed in 2.1.0 CWE-311

TI-2025-36915 CVE-2025-59354 · GHSA-hx2h-vjw2-8r54

Dragonfly has weak integrity checks for downloaded files

LOW 30

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00163 Published 2025-09-17 Fixed in 2.1.0 CWE-328

TI-2025-36914 CVE-2025-59353 · GHSA-255v-qv84-29p5

Manager generates mTLS certificates for arbitrary IP addresses

LOW 39

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00232 Published 2025-09-17 Fixed in 2.1.0 CWE-295

TI-2025-36913 CVE-2025-59352 · GHSA-79hx-3fp8-hj66

Dragonfly allows arbitrary file read and write on a peer machine

LOW 38

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00729 Published 2025-09-17 Fixed in 2.1.0 CWE-202

TI-2025-36912 CVE-2025-59351 · GHSA-4mhv-8rh3-4ghw

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

LOW 19

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00314 Published 2025-09-17 Fixed in 2.1.0 CWE-476

TI-2025-36911 CVE-2025-59350 · GHSA-c2fc-9q9c-5486

Timing attacks against Proxy’s basic authentication are possible

LOW 20

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00338 Published 2025-09-17 Fixed in 2.1.0 CWE-208

TI-2025-36910 CVE-2025-59349 · GHSA-8425-8r2f-mrv6

Directories created via os.MkdirAll are not checked for permissions

LOW 10

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0LOW 2.0 Local No auth No interaction EPSS 0.00116 Published 2025-09-17 Fixed in 2.1.0 CWE-732

TI-2025-36909 CVE-2025-59348 · GHSA-2qgr-gfvj-qpcr

Dragonfly incorrectly handles a task structure’s usedTraffic field

MEDIUM 64

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00358 Published 2025-09-17 Fixed in 2.1.0 CWE-457

TI-2025-36908 CVE-2025-59347 · GHSA-98x5-jw98-6c97

Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

MEDIUM 53

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.0017 Published 2025-09-17 Fixed in 2.1.0 CWE-295

TI-2025-36907 CVE-2025-59346 · GHSA-g2rq-jv54-wcpr

Dragonfly server-side request forgery vulnerability

MEDIUM 64

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00248 Published 2025-09-17 Fixed in 2.1.0 CWE-918

TI-2025-36906 CVE-2025-59345 · GHSA-89vc-vf32-ch59

Dragonfly did not enable authentication for some Manager’s endpoints

MEDIUM 40

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00384 Published 2025-09-17 Fixed in 2.1.0 CWE-306

TI-2023-12294 CVE-2023-27584 · GHSA-hpc8-7wpm-889w

Dragonfly2 vulnerable to hard coded cyptographic key

HIGH 82

Dragonfly is an open source P2P-based file distribution and image acceleration system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33874 Published 2024-09-19 Fixed in 2.0.9, 2.1.0-beta.1 +1 CWE-321

Vulnerabilities

Filters