Timing attacks against Proxy’s basic authentication are possible

published 2025-09-17 13 mo ago modified 2026-06-17 4 mo ago also GHSA-c2fc-9q9c-5486 , GO-2025-3972 , EUVD-2025-29771

cvss: 5.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0.

Patch / fix

fixed in 3 distros 2 links 1

go github.com/dragonflyoss/dragonfly 2.1.0
go d7y.io/dragonfly/v2 2.1.0
linuxfoundation dragonfly 2.1.0

suse opensuse

govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20251023T162509-150000.1.110.1

suse advisories SUSE-SU-2025:3799-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
govulncheck-vulndb openSUSE Tumbleweed 0.0.20250924T192141-1.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2025:15576-1

github.com/dragonflyoss/dragonfly/security/advisories/GHSA-c2fc-9q9c-… advisory

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 13 mo ago (2025-09-18)

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CNA	4.0	2.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/dragonflyoss/dragonfly	<2.1.0 all versions	2.1.0
go	d7y.io/dragonfly/v2	<2.1.0	2.1.0

Affected products

dragonflyoss dragonfly

Classification

Weakness

CWE-208 Observable Timing Discrepancy
CWE-697 Incorrect Comparison

References

github.com /dragonflyoss/dragonfly/security/advisories/GHSA-c2fc-9q9c-5486
web, patch, third-party-advisory, advisory
github.com /dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf
web, product
nvd.nist.gov /vuln/detail/CVE-2025-59350
advisory
github.com /dragonflyoss/dragonfly
package
pkg.go.dev /vuln/GO-2025-3972
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary