High severity · published Sep 17, 2025
CVE-2025-59353
Dragonfly is an open source P2P-based file distribution and image acceleration system
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Dragonfly · Linuxfoundation
before 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59353
Product
https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
Exploit
https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-255v-qv84-29p5
More from Dragonfly
9.8
CVE-2026-24124
Dragonfly is an open source P2P-based file distribution and image acceleration system
9.8
CVE-2025-59352
Dragonfly is an open source P2P-based file distribution and image acceleration system
9.8
CVE-2023-27584
Dragonfly is an open source P2P-based file distribution and image acceleration system
9.1
CVE-2025-59345
Dragonfly is an open source P2P-based file distribution and image acceleration system
7.5
CVE-2025-59348
Dragonfly is an open source P2P-based file distribution and image acceleration system