Go/github.com/dragonflyoss/dragonfly CVE-2025-59354: medium 5.3, EPSS 0.16%

DragonFly has weak integrity checks for downloaded files

Action: Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.

go get github.com/dragonflyoss/dragonfly@v2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-hx2h-vjw2-8r54
• nvd: CVE-2025-59354
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-hx2h-vjw2-8r54
• https://github.com/dragonflyoss/dragonfly
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
• https://pkg.go.dev/vuln/GO-2025-3973

CVE-2025-59354 · published 2025-09-17T20:11:58Z · modified 2025-09-26T16:19:42Z · JSON