Home

Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.

PUBLISHED Reserved 2025-09-12 | Published 2025-09-17 | Updated 2025-09-18 | Assigner GitHub_M




MEDIUM: 5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Problem types

CWE-328: Use of Weak Hash

Product status

< 2.1.0
affected

References

github.com/...gonfly/security/advisories/GHSA-hx2h-vjw2-8r54

github.com/...curity/dragonfly-comprehensive-report-2023.pdf

cve.org (CVE-2025-59354)

nvd.nist.gov (CVE-2025-59354)

Download JSON