mTLS Authentication Weakness in Dragonfly from DragonflyOSS
CVE-2025-59353

7.7HIGH

Key Information:

Vendor

Dragonflyoss

Status
Dragonfly
Vendor
CVE Published:
17 September 2025

What is CVE-2025-59353?

Dragonfly, an open source P2P-based file distribution and image acceleration system, has a vulnerability that allows peers to obtain valid TLS certificates for arbitrary IP addresses before version 2.1.0. The flaw lies in the Manager’s Certificate gRPC service, which fails to verify whether the requested IP address corresponds to the peer initiating the certificate request. This oversight effectively undermines mTLS authentication, leaving systems potentially exposed. Users are recommended to update to version 2.1.0 or later to mitigate this risk.

Affected Version(s)

dragonfly < 2.1.0

References

https://github.com/dragonflyoss/dragonfly/security/adviso...
x_refsource_CONFIRM
https://github.com/dragonflyoss/dragonfly/blob/main/docs/...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59353 : mTLS Authentication Weakness in Dragonfly from DragonflyOSS