P2P File Distribution System Vulnerability in Dragonfly by Dragonfly OSS

CVE-2025-59410

What is CVE-2025-59410?

Dragonfly, an open-source P2P file distribution and image acceleration system, has a vulnerability where the code in its scheduler for downloading small files is hardcoded to use the HTTP protocol rather than the more secure HTTPS. This oversight exposes users to potential Man-in-the-Middle attacks, where malicious actors can intercept and modify network requests, allowing them to deliver incorrect or harmful data to users. Users are strongly advised to upgrade to version 2.1.0 or later, where this vulnerability has been addressed.

References