Skip to main content

Use of Uninitialized Variable

CVE-2025-59348

Medium
5.5/10

Summary

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to the version 2.1.3, the "processPieceFromSource" method does not update the structures "usedTraffic" field, because an uninitialized variable 'n' is used as a guard to the "AddTraffic" method call, instead of the "result.Size" variable. A task is processed by a peer. The "usedTraffic" metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a Denial-of-Service (DoS) condition for the peer.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-457 - Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

References

Advisory Timeline

  • Published