CVE-2025-59353
Last modified
CVE-2025-59353 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Dragonfly | < 2.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59353?
How severe is CVE-2025-59353?
How do I fix CVE-2025-59353?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59348Dragonfly is an open source P2P-based file distribution and …7.5
- CVE-2025-59349Dragonfly is an open source P2P-based file distribution and …3.3
- CVE-2025-5935A vulnerability was found in Open5GS up to 2.7.3. It has bee…7.5
- CVE-2025-59350Dragonfly is an open source P2P-based file distribution and …5.3
- CVE-2025-59351Dragonfly is an open source P2P-based file distribution and …5.3
- CVE-2025-59352Dragonfly is an open source P2P-based file distribution and …9.8
- CVE-2025-59354Dragonfly is an open source P2P-based file distribution and …5.3
- CVE-2025-59355A vulnerability. When org.apache.linkis.metadata.util.HiveU…6.5
- CVE-2025-59358The Chaos Controller Manager in Chaos Mesh exposes a GraphQL…7.5
- CVE-2025-59359The cleanTcs mutation in Chaos Controller Manager is vulnera…9.8
- CVE-2025-5936The VR Calendar plugin for WordPress is vulnerable to Cross-…4.3
- CVE-2025-59360The killProcesses mutation in Chaos Controller Manager is vu…9.8
Are you affected by CVE-2025-59353?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST