- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 11 · 2 high, 5 medium, 4 low
- Registry
- pkg.go.dev
Advisories 11
- CVE-2025-59410Medium 5.5
Dragonfly tiny file download uses hard coded HTTP protocol
Affected: fixed in 2.1.0; all versions.
- CVE-2025-59354Medium 5.5
Dragonfly has weak integrity checks for downloaded files
Affected: fixed in 2.1.0; all versions.
- CVE-2025-59353High 7.7
Manager generates mTLS certificates for arbitrary IP addresses
Affected: fixed in 2.1.0; all versions.
- CVE-2025-59352Medium 6.9
Dragonfly allows arbitrary file read and write on a peer machine
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59351Low 2.7
Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59350Low 2.7
Timing attacks against Proxy’s basic authentication are possible
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59349Low 2.0
Directories created via os.MkdirAll are not checked for permissions
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59348Medium 5.5
Dragonfly incorrectly handles a task structure’s usedTraffic field
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59347Low 2.7
Dragonfly Manager makes requests to external endpoints with disabled TLS authentication
Affected: fixed in 2.1.0; all versions.
- CVE-2025-59346Medium 5.5
Dragonfly server-side request forgery vulnerability
Affected: all versions; fixed in 2.1.0.
- CVE-2025-59345High 7.7
Dragonfly did not enable authentication for some Manager’s endpoints
Affected: fixed in 2.1.0; all versions.