GHSA-2qgr-gfvj-qpcr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2qgr-gfvj-qpcr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2qgr-gfvj-qpcr/GHSA-2qgr-gfvj-qpcr.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-2qgr-gfvj-qpcr
- Aliases
- Published
- 2025-09-17T19:48:41Z
- Modified
- 2025-09-26T16:17:10Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- Dragonfly incorrectly handles a task structure’s usedTrac field
- Details
-
Impact
The processPieceFromSource method (figure 4.1) is part of a task processing mechanism. The method writes pieces of data to storage, updating a Task structure along the way. The method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable.
var n int64 result.Size, err = pt.GetStorage().WritePiece([skipped]) result.FinishTime = time.Now().UnixNano() if n > 0 { pt.AddTraffic(uint64(n)) }A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer.
Patches
- Dragonfy v2.1.0 and above.
Workarounds
There are no effective workarounds, beyond upgrading.
References
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.
- Database specific
{ "nvd_published_at": "2025-09-17T20:15:37Z", "cwe_ids": [ "CWE-457" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-09-17T19:48:41Z" }- References
-
- https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-2qgr-gfvj-qpcr
- https://nvd.nist.gov/vuln/detail/CVE-2025-59348
- https://github.com/dragonflyoss/dragonfly
- https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
- https://pkg.go.dev/vuln/GO-2025-3963
Affected packages
Go / github.com/dragonflyoss/dragonfly
Package
- Name
- github.com/dragonflyoss/dragonfly
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/dragonflyoss/dragonfly
Go / d7y.io/dragonfly/v2
Package
- Name
- d7y.io/dragonfly/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/d7y.io/dragonfly/v2