Platform
go
Component
d7y.io/dragonfly/v2
Fixed in
2.1.1
2.1.0
CVE-2025-59346 describes a server-side request forgery (SSRF) vulnerability discovered in Dragonfly v2. This flaw allows an attacker to manipulate the application into making requests to unintended internal or external resources, potentially leading to unauthorized access and data exposure. The vulnerability impacts versions of Dragonfly prior to 2.1.0, and a patch has been released to address the issue.
An attacker exploiting this SSRF vulnerability could potentially bypass security controls and access sensitive internal resources that are not directly exposed to the internet. This could include accessing internal APIs, databases, or configuration files. Depending on the internal services accessible, an attacker could potentially achieve data exfiltration, privilege escalation, or even gain control of other systems within the network. The blast radius extends to any internal resources accessible via HTTP/HTTPS requests initiated by the Dragonfly application.
CVE-2025-59346 was publicly disclosed on 2025-09-24. There is no indication of active exploitation at this time. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not yet available, but the SSRF nature of the vulnerability suggests that they are likely to emerge.
Exploit Status
EPSS
0.06% (19% percentile)
CISA SSVC
The primary mitigation for CVE-2025-59346 is to upgrade to Dragonfly version 2.1.0 or later, which includes the necessary fix. If upgrading immediately is not feasible, implement strict network policies to restrict outbound connections from the Dragonfly application. This can be achieved through firewalls or proxy servers. Additionally, implement robust input validation to sanitize any user-supplied data that is used to construct URLs. Consider using a Web Application Firewall (WAF) with SSRF protection rules to further mitigate the risk.
Update Dragonfly to version 2.1.0 or later. This version contains the fix for the SSRF (Server-Side Request Forgery) vulnerability. Ensure you follow the upgrade instructions provided by the vendor.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-59346 is a server-side request forgery vulnerability in Dragonfly v2, allowing attackers to make requests to unintended resources. It has a CVSS score of 7.5 (HIGH).
You are affected if you are using Dragonfly v2 prior to version 2.1.0. Upgrade immediately to mitigate the risk.
Upgrade to Dragonfly v2.1.0 or later. As a temporary workaround, implement strict network policies and input validation.
There is currently no indication of active exploitation, but the SSRF nature of the vulnerability suggests potential for future exploitation.
Refer to the official d7y.io/dragonfly project repository and associated security advisories for updates and detailed information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.