CVE-2025-59353
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-17

Last updated on: 2025-09-18

Assigner: GitHub, Inc.

Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-17
Last Modified
2025-09-18
Generated
2026-06-16
AI Q&A
2025-09-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-59353
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linuxfoundation dragonfly to 2.1.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-295 The product does not validate, or incorrectly validates, a certificate.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Dragonfly (prior to version 2.1.0) allows a peer to obtain a valid TLS certificate for arbitrary IP addresses because the Manager's Certificate gRPC service does not verify that the IP address requested in the certificate belongs to the peer making the request. As a result, mutual TLS (mTLS) authentication can be bypassed, undermining the security of the system.

Impact Analysis

This vulnerability can impact you by allowing unauthorized peers to impersonate other IP addresses within the Dragonfly network, effectively bypassing mTLS authentication. This can lead to unauthorized access, potential data interception, or manipulation within the file distribution and image acceleration system.

Mitigation Strategies

Upgrade Dragonfly to version 2.1.0 or later, as this version contains the fix that properly validates the IP addresses in certificate requests, preventing unauthorized issuance of TLS certificates.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart