https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:20:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-253034 EUVD-2026-253034 https://cve.radiocsirt.org/vuln/euvd-2026-253034 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59410 <p>Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. This vulnerability is fixed in 2.1.0.</p> <p>Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. This vulnerability is fixed in 2.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59410 https://cve.radiocsirt.org/vuln/ghsa-mcvp-rpgg-9273 <p><strong>Affected:</strong> Go: github.com/dragonflyoss/dragonfly, Go: d7y.io/dragonfly/v2</p> <p>### Impact The code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. Due to the use of weak integrity checks (TOB-DF2-15), this modification of the data may go unnoticed.</p> <p>```golang // DownloadTinyFile downloads tiny file from peer without range. func (p *Peer) DownloadTinyFile() ([]byte, error) { ctx, cancel := context.WithTimeout(context.Background(), downloadTinyFileContextTimeout) defer cancel() // Download url: http://${host}:${port}/download/${taskIndex}/${taskID}?peerId=${peerID} targetURL := url.URL{ Scheme: } &#34;http&#34;, fmt.Sprintf(&#34;%s:%d&#34;, p.Host.IP, p.Host.DownloadPort), fmt.Sprintf(&#34;download/%s/%s&#34;, p.Task.ID[:3], p.Task.ID), Host: Path: RawQuery: fmt.Sprintf(&#34;peerId=%s&#34;, p.ID), ```</p> <p>A network-level attacker who cannot join a peer-to-peer network performs a Man-in-the-Middle attack on peers. The adversary can do this because peers (partially) communicate over plaintext HTTP protocol. The attack chains this vulnerability with the one described in TOB-DF2-15 to replace correct files with malicious ones. Unconscious peers use the malicious files.</p> <p>### Patches</p> <p>- Dragonfy v2.1.0 and above.</p> <p>### Workarounds</p> <p>There are no effective workarounds, beyond upgrading.</p> <p>### References</p> <p>A third party security audit was performed by Trail of Bits, you…</p> <p><strong>Affected:</strong> Go: github.com/dragonflyoss/dragonfly, Go: d7y.io/dragonfly/v2</p> <p>### Impact The code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. Due to the use of weak integrity checks (TOB-DF2-15), this modification of the data may go unnoticed.</p> <p>```golang // DownloadTinyFile downloads tiny file from peer without range. func (p *Peer) DownloadTinyFile() ([]byte, error) { ctx, cancel := context.WithTimeout(context.Background(), downloadTinyFileContextTimeout) defer cancel() // Download url: http://${host}:${port}/download/${taskIndex}/${taskID}?peerId=${peerID} targetURL := url.URL{ Scheme: } &#34;http&#34;, fmt.Sprintf(&#34;%s:%d&#34;, p.Host.IP, p.Host.DownloadPort), fmt.Sprintf(&#34;download/%s/%s&#34;, p.Task.ID[:3], p.Task.ID), Host: Path: RawQuery: fmt.Sprintf(&#34;peerId=%s&#34;, p.ID), ```</p> <p>A network-level attacker who cannot join a peer-to-peer network performs a Man-in-the-Middle attack on peers. The adversary can do this because peers (partially) communicate over plaintext HTTP protocol. The attack chains this vulnerability with the one described in TOB-DF2-15 to replace correct files with malicious ones. Unconscious peers use the malicious files.</p> <p>### Patches</p> <p>- Dragonfy v2.1.0 and above.</p> <p>### Workarounds</p> <p>There are no effective workarounds, beyond upgrading.</p> <p>### References</p> <p>A third party security audit was performed by Trail of Bits, you…</p> https://cve.radiocsirt.org/vuln/ghsa-mcvp-rpgg-9273 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15576-1 <p>govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15576-1