# d7y.io/dragonfly/v2 (Go) vulnerabilities 15 known vulnerabilities (1 critical, 3 high, 6 medium, 5 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.5.3 (Oct 27, 2026): no advisory affects it - Newest unaffected release: v2.5.3 (Oct 27, 2026), the latest release - Releases: 337 since v2.0.0 (Sep 9, 2021) - Registry: https://pkg.go.dev/d7y.io/dragonfly/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-49254: v2.0.0-alpha to v2.4.4-rc.4 (v2.4.4 is outside it) - CVE-2026-54637: v2.0.0-alpha to v2.4.4-rc.2 (v2.4.4-rc.3 is outside it) - CVE-2026-24124: v2.0.0-alpha to v2.4.1-rc.1 (v2.4.1 is outside it) - CVE-2025-59410: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59354: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59353: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59352: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59351: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59350: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59349: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59348: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59347: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59346: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2025-59345: v2.0.0-alpha to v2.1.0-rc.0 (v2.1.0 is outside it) - CVE-2023-27584: v2.0.0-alpha to v2.1.0-beta.0 (v2.1.0-beta.1 is outside it) ## Advisories (15) ### [CVE-2026-49254](https://cve.now/CVE-2026-49254): Dragonfly Manager OAuth provider client\_secret disclosure via unauthenticated GET /api/v1/oauth - Severity: Low 2.9 - Published: Sep 15, 2026 - Affected: fixed in 2.4.4. - Fixed in v2.4.4 (released Jun 25, 2026, 82 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2026-54637](https://cve.now/CVE-2026-54637): Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile - Severity: Medium 5.5 - Published: Sep 15, 2026 - Affected: fixed in 2.4.4-rc.3. - Fixed in v2.4.4-rc.3 (released Jun 9, 2026, 98 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2026-24124](https://cve.now/CVE-2026-24124): Dragonfly Manager Job API Allows Unauthenticated Access - Severity: High 8.9 - Published: Jan 22, 2026 - Affected: fixed in 2.4.1. - Fixed in v2.4.1 (released Jan 23, 2026, 1 day after disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59410](https://cve.now/CVE-2025-59410): Dragonfly tiny file download uses hard coded HTTP protocol - Severity: Medium 5.5 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59354](https://cve.now/CVE-2025-59354): Dragonfly has weak integrity checks for downloaded files - Severity: Medium 5.5 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59353](https://cve.now/CVE-2025-59353): Manager generates mTLS certificates for arbitrary IP addresses - Severity: High 7.7 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59352](https://cve.now/CVE-2025-59352): Dragonfly allows arbitrary file read and write on a peer machine - Severity: Medium 6.9 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59351](https://cve.now/CVE-2025-59351): Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error - Severity: Low 2.7 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59350](https://cve.now/CVE-2025-59350): Timing attacks against Proxy’s basic authentication are possible - Severity: Low 2.7 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59349](https://cve.now/CVE-2025-59349): Directories created via os.MkdirAll are not checked for permissions - Severity: Low 2.0 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59348](https://cve.now/CVE-2025-59348): Dragonfly incorrectly handles a task structure’s usedTraffic field - Severity: Medium 5.5 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59347](https://cve.now/CVE-2025-59347): Dragonfly Manager makes requests to external endpoints with disabled TLS authentication - Severity: Low 2.7 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59346](https://cve.now/CVE-2025-59346): Dragonfly server-side request forgery vulnerability - Severity: Medium 5.5 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2025-59345](https://cve.now/CVE-2025-59345): Dragonfly did not enable authentication for some Manager’s endpoints - Severity: High 7.7 - Published: Sep 17, 2025 - Affected: fixed in 2.1.0. - Fixed in v2.1.0 (released Aug 4, 2023, 775 days before disclosure). - The latest release, v2.5.3, is not affected. ### [CVE-2023-27584](https://cve.now/CVE-2023-27584): Dragonfly2 vulnerable to hard coded cyptographic key - Severity: Critical 9.8 - Published: Sep 19, 2024 - Affected: fixed in 2.1.0-beta.1; from 2.1.0-alpha.0, fixed in 2.1.0-beta.1; fixed in 2.0.9-rc.2. - Fixed in v2.1.0-beta.1 (released Jun 28, 2023, 449 days before disclosure). - The latest release, v2.5.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/d7y.io/dragonfly/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.