DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error

We found two instances in the DragonFly codebase where the first return value of a function is dereferenced even when the function returns an error figures 9.1 and 9.2. This can result in a nil dereference, and cause code to panic. The codebase may contain additional instances of the bug. golang...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from the proxy function access control mechanism using simple string comparisons, which is vulnerable to...

Dragonfly 代码问题漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A code issue vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from a function returning an error but still dereferencing the first return value, potentially resulting i...

PT-2025-38272

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description A peer can obtain a valid TLS certificate for arbitrary IP addresses, rendering the mTLS authentication ineffective. The Manager’s Certificate gRPC service does not validate if the requested IP...

Dragonfly 信任管理问题漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A trust management issue vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from disabling TLS certificate validation, which could lead to man-in-the-middle attacks and...

Dragonfly 代码问题漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A code issue vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from the Manager API accepting a user-supplied URL with insufficient validation when creating a Preheat jo...

PT-2025-38260

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly2 uses the os.MkdirAll function to create directory paths with specific access permissions. This function does not perform permission checks if a directory path already exists, allowing a...

PT-2025-38258

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly, an open source P2P-based file distribution and image acceleration system, disables TLS certificate verification in its HTTP clients. These clients are not configurable, preventing users...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from the Manager's Certificate gRPC service not verifying that the requesting IP address belongs to the peer...

PT-2025-38274

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly, an open source P2P-based file distribution and image acceleration system, is susceptible to a Man-in-the-Middle attack. The scheduler for downloading small files was configured to use th...

PT-2025-38253

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description The /api/v1/jobs and /preheats endpoints in the Manager web UI are accessible without authentication. An unauthenticated adversary with network access to a Manager web UI can create, delete, and...

PT-2025-38271

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly’s gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations and to read arbitrary files. This can allow peers to...

DragonFly's tiny file download uses hard coded HTTP protocol

The code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. Due to the use of weak integrity...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from a gRPC API and HTTP API that allows a peer node to send a request to force a receiving node to create a...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from the use of insecure hash functions such as MD5, which could lead to malicious file replacement...

Dragonfly 访问控制错误漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. An access control error vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from the /api/v1/jobs and /preheats endpoints being accessible without authentication,...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0, which stems from an uninitialized variable n being used as a protection condition for an AddTraffic method call, resulti...

PT-2025-38273

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly2 uses the MD5 hash function for downloaded files, which does not provide collision resistance. This allows attackers to replace files with malicious ones that have a colliding hash. An...

Dragonfly 安全漏洞

Dragonfly is an open source framework from DragonflyDB that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly versions prior to 2.1.0 that stems from the os.MkdirAll function not performing permission checks on existing directory paths, which could lead t...

PT-2025-38259

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description The processPieceFromSource method in Dragonfly does not correctly update the usedTraffic field within the Task structure due to the use of an uninitialized variable n instead of result.Size when...