Go/github.com/dragonflyoss/dragonfly CVE-2025-59410: low 3.7, EPSS 0.14%

DragonFly's tiny file download uses hard coded HTTP protocol

Action: Upgrade github.com/dragonflyoss/dragonfly to 2.1.0 or later.

go get github.com/dragonflyoss/dragonfly@v2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-mcvp-rpgg-9273
• https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-mcvp-rpgg-9273
• https://nvd.nist.gov/vuln/detail/CVE-2025-59410
• https://github.com/dragonflyoss/dragonfly
• https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
• https://pkg.go.dev/vuln/GO-2025-3974

CVE-2025-59410 · published 2025-09-17T20:23:25Z · modified 2025-09-26T16:20:03Z · JSON