CVE-2025-58369

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Uncontrolled Resource Consumption. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS session, if one side of the connection shuts down `write` while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. The CPU is consumed until the overall connection is closed, potentially shutting down a fs2-io powered server. This issue is fixed in versions 2.5.13, 3.12.1, and 3.13.0-M7.

Rincian

Terbit di NVD

5 September 2025

Terakhir diubah

1 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/typelevel/fs2/commit/46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976
• https://github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c
• https://github.com/typelevel/fs2/commit/edf0c4f2e660360d1c1a8c5377ce32294de89238
• https://github.com/typelevel/fs2/issues/3590
• https://github.com/typelevel/fs2/releases/tag/v3.12.2
• https://github.com/typelevel/fs2/releases/tag/v3.13.0-M7
• https://github.com/typelevel/fs2/security/advisories/GHSA-rrw2-px9j-qffj