# CVE-2025-59410: GO-2025-3974 - DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly

Source: https://junglewise.ai/threats/cve-2025-59410-dragonfly-s-tiny-file-download-uses-hard-coded-http-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24  
License: CC BY 4.0 with a link back

CVE-2025-59410 · Severity: low · CVSS 3.1 · Published 2025-09-24

DragonFly's tiny file download uses hard coded HTTP protocol in d7y.io/dragonfly

Technologies: [d7y.io/dragonfly/v2 (Go)](https://junglewise.ai/threats/technologies/d7y-io-dragonfly-v2), [github.com/dragonflyoss/dragonfly (Go)](https://junglewise.ai/threats/technologies/github-com-dragonflyoss-dragonfly). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-59410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59410 being exploited in the wild.

**How severe is CVE-2025-59410?** Low severity, with a CVSS score of 3.1, published 24 September 2025.

**Which products and versions are affected?** d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0; github.com/dragonflyoss/dragonfly (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.1.0.

**Is there a fix for CVE-2025-59410?** Yes. d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0 or later; github.com/dragonflyoss/dragonfly (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-59410?** Check whether you run d7y.io/dragonfly/v2 (Go) or github.com/dragonflyoss/dragonfly (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- d7y.io/dragonfly/v2 (Go): upgrade to 2.1.0 or later

  ```sh
  go get d7y.io/dragonfly/v2@v2.1.0
  ```

- github.com/dragonflyoss/dragonfly (Go): upgrade to 2.1.0 or later

  ```sh
  go get github.com/dragonflyoss/dragonfly@v2.1.0
  ```


## Affected products

- d7y.io/dragonfly/v2 (Go) SEMVER:introduced=0,fixed=2.1.0
- github.com/dragonflyoss/dragonfly (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.1.0

## Identifiers

- CVE-2025-59410
- GHSA-mcvp-rpgg-9273
- GO-2025-3974

## Related threats

- [Dragonfly Dragonfly scheduler unauthenticated SSRF in DownloadTinyFile](https://junglewise.ai/threats/cve-2026-54637-dragonfly-dragonfly-scheduler-unauthenticated-ssrf-in)
- [Dragonfly Manager OAuth client_secret disclosure in API](https://junglewise.ai/threats/cve-2026-49254-dragonfly-manager-oauth-client-secret-disclosure-in-api)
- [GO-2026-4356 - Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2026-24124-dragonfly-manager-job-api-unauthenticated-access)
- [GO-2025-3972 - Dragonfly vulnerable to timing attacks against Proxy’s basic authentication in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59350-dragonfly-vulnerable-to-timing-attacks-against-proxy-s-basic)
- [GO-2025-3968 - Dragonfly vulnerable to server-side request forgery in d7y.io/dragonfly](https://junglewise.ai/threats/cve-2025-59346-dragonfly-vulnerable-to-server-side-request-forgery)