The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times.
The vulnerability is shown in figure 8.1, where both the username and password are compared with a short-circuiting equality operation.
if user != proxy.basicAuth.Username || pass != proxy.basicAuth.Password {
It is currently undetermined what an attacker may be able to do with access to the proxy password.
There are no effective workarounds, beyond upgrading.
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at [email protected].
| Score | Percentile |
|---|---|
| 0.08% | 23.39% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.5 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-c2fc-9q9c-5486 ↗ |
| CVE | CVE-2025-59350 ↗ |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | github.com/dragonflyoss/dragonfly | < 2.1.0 | 2.1.0 | — |
| go | d7y.io/dragonfly/v2 | < 2.1.0 | 2.1.0 | — |