CVE-2025-58369 - CVE House
Back to Database
Status published Medium CVE-2025-58369

fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Vulnerability Description

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS session, if one side of the connection shuts down `write` while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. The CPU is consumed until the overall connection is closed, potentially shutting down a fs2-io powered server. This issue is fixed in versions 2.5.13, 3.12.1, and 3.13.0-M7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58369

Credits & Attribution

No credits recorded in the NVD database.

References

More from typelevel

View All →
CVE-2023-50730
Grackle has StackOverflowError in GraphQL query processing
High 7.5
CVE-2022-31183
mTLS client verification is skipped in fs2 on Node.js
Critical 9.1
CVE-2022-21653
Hash collision in typelevel jawn
Medium 5.9

Affected Vendor

Affected Software

fs2
Vulnerable Versions:
>= 3.0.0-M1, < 3.12.2, >= 3.13.0-M1, < 3.13.0-M7, < 2.5.13

Timeline

Official Publish: September 5th, 2025
Last Modified: November 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact