PT-2025-36337 · Fs2-Io +1 · Fs2-Io +1

Mpilquist · Published 2025-09-05 · Updated 2025-09-06 · CVE-2025-58369

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions:

fs2 versions 3.12.2 and lower

fs2 versions 3.13.0-M1 through 3.13.0-M6

Description:

fs2, a compositional, streaming I/O library for Scala, is susceptible to denial of service attacks through TLS sessions when using `fs2-io` on the JVM with the `fs2.io.net.tls` package. During TLS handshake establishment, if one side closes the `write` stream while the peer is awaiting further data, the peer can enter a CPU spin loop on socket read, consuming CPU resources until the connection closes. This can potentially disrupt an `fs2-io` powered server.

Recommendations:

Upgrade to fs2 version 3.12.1 or later.

Upgrade to fs2 version 3.13.0-M7 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-58369

Affected Products

Fs2

Fs2-Io

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-58369 · Security Note
• https://github.com/typelevel/fs2/issues/3590 · Note
• https://github.com/typelevel/fs2/releases/tag/v3.13.0-M7 · Note
• https://github.com/typelevel/fs2/commit/46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976 · Note
• https://github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c · Note
• https://github.com/typelevel/fs2/releases/tag/v3.12.2 · Note
• https://github.com/typelevel/fs2/security/advisories/GHSA-rrw2-px9j-qffj · Note
• https://twitter.com/CVEnew/status/1964195412665110803 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1964275721980850532 · Twitter Post
• https://t.me/CVEtracker/31831 · Telegram Post