GoPackage

d7y.io/dragonfly/v2

15 known vulnerabilities (1 critical, 3 high, 6 medium, 5 low), with the versions each affects and the releases that fix them.

Latest release: v2.5.3 (Oct 27, 2026): no advisory affects it
Newest unaffected release: v2.5.3 (Oct 27, 2026), the latest release
Advisories: 15 · 1 critical, 3 high, 6 medium, 5 low

Releases: 337 since v2.0.0 (Sep 9, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-49254
Affects v2.0.0-alpha to v2.4.4-rc.4 (v2.4.4 is outside it)
CVE-2026-54637
Affects v2.0.0-alpha to v2.4.4-rc.2 (v2.4.4-rc.3 is outside it)
CVE-2026-24124
Affects v2.0.0-alpha to v2.4.1-rc.1 (v2.4.1 is outside it)
CVE-2025-59410
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59354
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59353
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59352
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59351
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59350
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59349
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59348
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59347
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)

Show all 15 advisoriesShow fewer advisories

CVE-2025-59346
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2025-59345
Affects v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it)
CVE-2023-27584
Affects v2.0.0-alpha to v2.1.0-beta.0 (v2.1.0-beta.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

CVE-2026-49254Low 2.9
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Affected: fixed in 2.4.4.
Fixed in v2.4.4 (released Jun 25, 2026, 82 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2026-54637Medium 5.5
Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
Affected: fixed in 2.4.4-rc.3.
Fixed in v2.4.4-rc.3 (released Jun 9, 2026, 98 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2026-24124High 8.9
Dragonfly Manager Job API Allows Unauthenticated Access
Affected: fixed in 2.4.1.
Fixed in v2.4.1 (released Jan 23, 2026, 1 day after disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59410Medium 5.5
Dragonfly tiny file download uses hard coded HTTP protocol
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59354Medium 5.5
Dragonfly has weak integrity checks for downloaded files
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59353High 7.7
Manager generates mTLS certificates for arbitrary IP addresses
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59352Medium 6.9
Dragonfly allows arbitrary file read and write on a peer machine
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59351Low 2.7
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59350Low 2.7
Timing attacks against Proxy’s basic authentication are possible
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59349Low 2.0
Directories created via os.MkdirAll are not checked for permissions
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59348Medium 5.5
Dragonfly incorrectly handles a task structure’s usedTraffic field
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59347Low 2.7
Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59346Medium 5.5
Dragonfly server-side request forgery vulnerability
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2025-59345High 7.7
Dragonfly did not enable authentication for some Manager’s endpoints
Affected: fixed in 2.1.0.
Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure).
The latest release, v2.5.3, is not affected.
CVE-2023-27584Critical 9.8
Dragonfly2 vulnerable to hard coded cyptographic key
Affected: fixed in 2.1.0-beta.1; from 2.1.0-alpha.0, fixed in 2.1.0-beta.1; fixed in 2.0.9-rc.2.
Fixed in v2.1.0-beta.1 (released Jun 28, 2023, 449 days before disclosure).
The latest release, v2.5.3, is not affected.