CVE-2025-59348: Dragonfly incorrectly handles a task structure’s usedTraffic field
Impact The processPieceFromSource method (figure 4.1) is part of a task processing mechanism. The method writes pieces of data to storage, updating a Task structure along the way. The method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable.
golang var n int64 result.Size, err = pt.GetStorage().WritePiece([skipped]) result.FinishTime = time.Now().UnixNano() if n > 0 { pt.AddTraffic(uint64(n)) }
A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer.
Patches
- Dragonfy v2.1.0 and above.
Workarounds
There are no effective workarounds, beyond upgrading.
References
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.
Other sources
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59348?
The severity of CVE-2025-59348 is classified as medium due to the potential for misuse of the traffic management functionality.
How do I fix CVE-2025-59348?
To fix CVE-2025-59348, upgrade Dragonfly to version 2.1.0 or later, where the vulnerability has been addressed.
What impact does CVE-2025-59348 have on users?
CVE-2025-59348 can lead to inaccurate traffic tracking within the Dragonfly system, potentially disrupting resource allocation.
Is CVE-2025-59348 exploitable remotely?
Yes, CVE-2025-59348 can be exploited remotely, allowing malicious actors to manipulate traffic data.
Can I continue using Dragonfly if I have not patched CVE-2025-59348?
While you can continue using Dragonfly without the patch, it is highly discouraged as it exposes your system to potential vulnerabilities.