Executive brief
DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
Affected products
- Go github.com/dragonflyoss/dragonfly
- Go d7y.io/dragonfly/v2
Junglewise Threat Intelligence
CVE-2025-59410: GO-2025-3974 - DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly
CVE-2025-59410 · Severity: low · CVSS 3.1 · Published 2025-09-24
Technologies: github.com/dragonflyoss/dragonfly (Go), d7y.io/dragonfly/v2 (Go). Vendors: Go.
Related threats
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthen
- Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GE
- GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly
- GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly
- GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly