PT-2025-36337 · Fs2-Io+1 · Fs2-Io+1

Mpilquist · Published 2025-09-05 · Updated 2025-11-07 · CVE-2025-58369

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions fs2 versions 3.12.2 and lower fs2 versions 3.13.0-M1 through 3.13.0-M6

Description fs2, a compositional, streaming I/O library for Scala, is susceptible to denial of service attacks through TLS sessions when using fs2-io on the JVM with the fs2.io.net.tls package. During TLS handshake establishment, if one side closes the write stream while the peer is awaiting further data, the peer can enter a CPU spin loop on socket read, consuming CPU resources until the connection closes. This can potentially disrupt an fs2-io powered server.

Recommendations Upgrade to fs2 version 3.12.1 or later. Upgrade to fs2 version 3.13.0-M7 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-58369

GHSA-RRW2-PX9J-QFFJ

Affected Products

Fs2

Fs2-Io

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58369.json · Exploit
• https://osv.dev/vulnerability/GHSA-rrw2-px9j-qffj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58369 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58369 · Vendor Advisory
• https://github.com/typelevel/fs2/pull/3624 · Note
• https://github.com/typelevel/fs2/commit/edf0c4f2e660360d1c1a8c5377ce32294de89238 · Note
• https://github.com/typelevel/fs2/issues/3590 · Note
• https://github.com/typelevel/fs2/releases/tag/v3.13.0-M7 · Note
• https://github.com/typelevel/fs2/security/advisories/GHSA-rrw2-px9j-qffj · Note
• https://github.com/typelevel/fs2/releases/tag/v3.12.2 · Note
• https://github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c · Note
• https://github.com/typelevel/fs2 · Note
• https://github.com/typelevel/fs2/commit/46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976 · Note
• https://t.me/CVEtracker/31831 · Telegram Post
• https://t.me/cveNotify/142073 · Telegram Post