CVE-2022-31183

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

EUVD-2022-6207

Malicious code in bioql PyPI...

EUVD-2025-27048

Malicious code in bioql PyPI...

CVE-2025-58369

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release after establishing a TLS session. An attacker can cause excessive CPU utilization by initiating a half-shutdown of the connection during the handshake, leading the peer to enter a spin loop on socke...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release after establishing a TLS session. An attacker can cause excessive CPU utilization by initiating a half-shutdown of the connection during the handshake, leading the peer to enter a spin loop on socke...

com.47deg:freestyle-http-http4s_2.11 (0.1.0), com.azavea.geotrellis:geotrellis-server-core_2.11 (>=4.0.1, <=4.2.0) +197 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (>=0.9.1, <=2.1.0)

co.fs2:fs2-io2.11 MAVEN version =0.9.1, =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =5.0.0-m1, =1.3.0, =0.1.0, =0.0.2, =0.12.7, =0.12.7, =0.12.7, =0.14.1, =0.16.1 and more Source cves: CVE-2025-58369 Source advisory: SNYK:JAVA-COFS2-13180115...

CVE-2025-58369

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS...

CVE-2025-58369 fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS...

CVE-2025-58369 fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side

fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS...

com.avast:sst-app-monix_3 (>=0.17.0, <=0.19.3), com.avast:sst-app-zio_3 (>=0.17.0, <=0.19.3) +105 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_3 (>=2.5.6, <=2.5.12)

co.fs2:fs2-io3 MAVEN version =2.5.6, =0.17.0, =0.17.0, =0.16.0, =0.17.0, =0.16.0, =0.17.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.16.0, =0.16.0, =0.16.0, =0.17.0, =0.17.0, =0.19.3 and more Source cves: CVE-2025-58369 Source advisory: GHSA-RRW2-PX9J-QFFJ...

com.spinoco:fs2-cassandra-test-support_2.12 (0.4.0-m3), com.spinoco:fs2-cassandra_2.12 (0.4.0-m3) potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (1.0.0-m3)

co.fs2:fs2-io2.12 MAVEN version 1.0.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.spinoco:fs2-cassandra-test-support2.12 0.4.0-m3 - com.spinoco:fs2-cassandra2.12 0.4.0-m3 Source cves: CVE-2025-58369...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.7.0), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +503 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (>=2.0.0, <=2.5.12)

co.fs2:fs2-io2.12 MAVEN version =2.0.0, =0.3.0, =0.22.0, =0.0.1, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.7.0, =0.7.0, =0.18.1, =0.17.0, =0.17.0, =0.1.21, =0.19.3 and more Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFFJ...

com.azavea.geotrellis:geotrellis-server-core_2.11 (>=4.0.1, <=4.2.0), com.azavea.geotrellis:geotrellis-server-ogc_2.11 (>=4.0.1, <=4.2.0) +81 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (1.0.5)

co.fs2:fs2-io2.11 MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.azavea.geotrellis:geotrellis-server-core2.11 =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =5.0.1, =0.12.0, =0.1.0, =0.38, =0.3...

com.github.barambani:http4s-extend_2.12 (>=0.0.8, <=0.0.13), com.spinoco:fs2-kafka_2.12 (0.2.0-rc1) +28 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.0-rc2)

co.fs2:fs2-io2.12 MAVEN version 0.10.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.barambani:http4s-extend2.12 =0.0.8, =0.0.13 - com.spinoco:fs2-kafka2.12 0.2.0-rc1 -...

com.github.eikek:mpc4s-client_2.12 (>=0.3.1, <=0.3.2), com.github.eikek:mpc4s-http_2.12 (>=0.3.1, <=0.3.2) potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (0.10.7)

co.fs2:fs2-io2.12 MAVEN version 0.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.github.eikek:mpc4s-client2.12 =0.3.1, =0.3.1, =0.3.2 Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFF...

com.ccadllc.cedi:dtrace-http4s_2.12 (1.5.0-rc1), com.github.gvolpe:http4s-tracer_2.12 (1.0-m5) +33 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (1.0.0-rc1)

co.fs2:fs2-io2.12 MAVEN version 1.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.12 and may be impacted: - com.ccadllc.cedi:dtrace-http4s2.12 1.5.0-rc1 - com.github.gvolpe:http4s-tracer2.12 1.0-m5 -...

GHSA-RRW2-PX9J-QFFJ FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

com.qvantel:jsonapi-scala-http4s-client_2.11 (>=6.0.1, <=6.1.0), org.http4s:http4s-argonaut_2.11 (0.18.0-m6) +21 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.10.0-m9)

co.fs2:fs2-io2.11 MAVEN version 0.10.0-m9 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.qvantel:jsonapi-scala-http4s-client2.11 =6.0.1, =6.1.0 - org.http4s:http4s-argonaut2.11 0.18.0-m6 -...

com.spinoco:fs2-cassandra-test-support_2.11 (0.4.0-m3), com.spinoco:fs2-cassandra_2.11 (0.4.0-m3) potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (1.0.0-m3)

co.fs2:fs2-io2.11 MAVEN version 1.0.0-m3 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.spinoco:fs2-cassandra-test-support2.11 0.4.0-m3 - com.spinoco:fs2-cassandra2.11 0.4.0-m3 Source cves: CVE-2025-58369...