CVE-2025-59354: dragonflyoss dragonfly Use of Weak Hash

Vulnerability summary

CVE-2025-59354 is a medium (CVSS 5.5) Use of Weak Hash vulnerability in dragonflyoss dragonfly. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.1% of scored vulnerabilities.

Timeline

1. 17-09-2025
   PublishedVulnerability first disclosed.
2. 18-09-2025
   Last modifiedVulnerability information updated.

Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.

• CWE-328Use of Weak HashThe product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).