How severe is CVE-2025-59354?

CVE-2025-59354 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2025-59354 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-59354?

CVE-2025-59354 affects Linuxfoundation Dragonfly. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-59354?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-59354 have an EU (EUVD) identifier?

Yes. CVE-2025-59354 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-29766.

When was CVE-2025-59354 published?

CVE-2025-59354 was published on 2025-09-17 and last updated on 2026-06-17.

CVE-2025-59354

CVE-2025-59354 is a medium-severity vulnerability in Linuxfoundation Dragonfly with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-328.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 5.5
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-29766
Weakness: CWE-328
Affected product: Linuxfoundation Dragonfly
Published: 2025-09-17
Last modified: 2026-06-17

Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.

Frequently asked questions

What is CVE-2025-59354?: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.
How severe is CVE-2025-59354?: CVE-2025-59354 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2025-59354 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-59354?: CVE-2025-59354 affects Linuxfoundation Dragonfly. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-59354?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-59354 have an EU (EUVD) identifier?: Yes. CVE-2025-59354 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-29766.
When was CVE-2025-59354 published?: CVE-2025-59354 was published on 2025-09-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:*

More vulnerabilities in Linuxfoundation Dragonfly

CVE-2026-24124 — Critical (CVSS 9.8): Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and…
CVE-2025-59352 — Critical (CVSS 9.8): Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and…
CVE-2023-27584 — Critical (CVSS 9.8): Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native…
CVE-2025-59345 — Critical (CVSS 9.1): Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs…
CVE-2025-59353 — High (CVSS 7.5): Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can…
CVE-2025-59348 — High (CVSS 7.5): Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the…

All CVEs affecting Linuxfoundation Dragonfly →

Other CWE-328 vulnerabilities

CVE-2026-36182 — Critical (CVSS 9.8): GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing…
CVE-2020-37168 — Critical (CVSS 9.8): Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force…
CVE-2025-41652 — Critical (CVSS 9.8): The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated…
CVE-2025-27595 — Critical (CVSS 9.8): The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily…
CVE-2022-45141 — Critical (CVSS 9.8): Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and…
CVE-2023-0452 — Critical (CVSS 9.8): Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A…

Browse all CWE-328 vulnerabilities →