DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error

🗓️ 17 Sep 2025 20:10:53Reported by GitHub Advisory DatabaseType

DragonFly panics from nil pointer dereference when first return value is used after an error.

Reporter	Title	Published	Views	Family All 55
CNNVD	Dragonfly 代码问题漏洞	17 Sep 202500:00	–	cnnvd
CVE	CVE-2025-59351	17 Sep 202519:46	–	cve
Cvelist	CVE-2025-59351 Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error	17 Sep 202519:46	–	cvelist
EUVD	EUVD-2025-29769	3 Oct 202520:07	–	euvd
GitLab Advisory Database	DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error	17 Sep 202500:00	–	gitlab
NVD	CVE-2025-59351	17 Sep 202520:15	–	nvd
OPENSUSE Linux	govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media (moderate)	26 Sep 202500:00	–	opensuse
OSV	CVE-2025-59351 Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error	17 Sep 202519:46	–	osv
OSV	GHSA-4MHV-8RH3-4GHW DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error	17 Sep 202520:10	–	osv
OSV	GO-2025-3970 DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly	24 Sep 202519:21	–	osv

Vulners

Node

dragonfly v2Range<2.1.0go

Source	Link
github	www.github.com/dragonflyoss/dragonfly/security/advisories/GHSA-4mhv-8rh3-4ghw
github	www.github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-59351
pkg	www.pkg.go.dev/vuln/GO-2025-3970
github	www.github.com/advisories/GHSA-4mhv-8rh3-4ghw

26 Sep 2025 16:18Current

7.1High risk

Vulners AI Score7.1

CVSS 3.15.3

CVSS 46.9

EPSS0.00075

SSVC