[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkL7RPUanFYxhNS5yPiv5ENs878AuLXNiBLDx61lyyX8":3,"g5a-risk:CVE-2025-59353":117},{"success":4,"data":5,"meta":114},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":31,"epssPercentile":26,"epssTimeSeries":32,"severity":33,"affectedProducts":34,"affectedProductsCount":40,"references":41,"referencesCount":52,"weaknesses":53,"weaknessesCount":52,"isActivelyExploited":69,"cisaInfo":26,"otxData":26,"relatedBlogPosts":70,"seoMetadata":71,"configurations":96,"relatedVendorCves":105,"notableEvents":106},"CVE-2025-59353","What is CVE-2025-59353?","Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.","Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrar...","2025-09-17T20:15:37.947","2025-09-18T20:08:55.557",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":30,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":25,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[],[],0.00232,[31,31,31,31,31,31,31],"High",[35],{"vendor":36,"product":37,"version":38,"criteria":39,"vulnerable":4},"linuxfoundation","dragonfly","*","cpe:2.3:a:linuxfoundation:dragonfly:*:*:*:*:*:go:*:*",1,[42,47],{"url":43,"source":44,"tags":45},"https:\u002F\u002Fgithub.com\u002Fdragonflyoss\u002Fdragonfly\u002Fblob\u002Fmain\u002Fdocs\u002Fsecurity\u002Fdragonfly-comprehensive-report-2023.pdf","GitHub",[46],"Product",{"url":48,"source":44,"tags":49},"https:\u002F\u002Fgithub.com\u002Fdragonflyoss\u002Fdragonfly\u002Fsecurity\u002Fadvisories\u002FGHSA-255v-qv84-29p5",[50,51],"Exploit","Patch",2,[54,62],{"id":55,"name":56,"description":57,"extendedDescription":58,"status":59,"abstraction":60,"structure":61},"CWE-295","Improper Certificate Validation","The product does not validate, or incorrectly validates, a certificate.","When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.","Draft","Base","Simple",{"id":63,"name":64,"description":65,"extendedDescription":66,"status":67,"abstraction":68,"structure":61},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.\nWhen access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.","Incomplete","Class",false,[],{"title":72,"metaDescription":73,"keywords":74,"canonicalUrl":75,"structuredData":76},"What is CVE-2025-59353? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2025-59353, a high severity cyber security vulnerability from 2025. Dragonfly is an open source P2P-based file distribution and...","CVE-2025-59353, CVE-2025-59353 vulnerability, CVE-2025-59353 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2025, CVSS score, exploit, patch, remediation, linuxfoundation security, dragonfly vulnerability","\u002Fwhat-is\u002Fcve-2025-59353",{"@context":77,"@type":78,"headline":72,"description":73,"datePublished":10,"dateModified":11,"author":79,"publisher":83,"about":87,"mainEntityOfPage":91,"articleSection":94,"keywords":95},"https:\u002F\u002Fschema.org","TechArticle",{"@type":80,"name":81,"url":82},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":80,"name":81,"url":82,"logo":84},{"@type":85,"url":86},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":88,"name":6,"description":89,"additionalType":90},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":92,"@id":93},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2025-59353","Cybersecurity","CVE-2025-59353, CVE-2025-59353 vulnerability, CVE-2025-59353 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[97],{"Operator":26,"Negate":26,"Nodes":98},[99],{"Operator":100,"Negate":69,"CPEMatch":101},"OR",[102],{"Vulnerable":4,"Criteria":39,"MatchCriteriaID":103,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":104,"VersionEndIncluding":26},"DD8FC947-C416-45E5-8B5A-0173CDA235B6","2.1.0",[],[107],{"id":108,"eventType":109,"eventTime":110,"details":111,"label":112,"color":113},"cc1ee7b4-1e7c-4224-9824-75db1f604f14","NEW_NVD","2025-09-18T04:01:04.270219+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":115,"version":116},1792436151658,"2.0",{"score":118,"band":119,"action":120,"scoredAt":121},56,"Medium","Plan remediation","2026-10-16T07:08:56.741315+00:00"]