com.azavea.geotrellis:geotrellis-server-core_2.11 (>=4.0.1 <=4.2.0), com.azavea.geotrellis:geotrellis-server-ogc_2.11 (>=4.0.1 <=4.2.0) +145 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (>=1.0.0-M1 <=1.1.0-M1)

co.fs2:fs2-io2.11 MAVEN version =1.0.0-M1, =4.0.1, =4.0.1, =4.0.1, =0.4.0, =0.4.0, =5.0.0, =2.0.0, =1.1.0, =1.0-M1, =0.10.0, =0.11.0, =0.1.0, =0.0.3, =0.0.3, =0.0.8 and more Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFFJ...

co.fs2:fs2-protocols_2.12 (>=3.10-4b5f50b <=3.12.1), com.47deg:github4s_2.12 (>=0.29.0 <=0.29.1) +440 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (>=3.0.0-M7 <=3.12.1)

co.fs2:fs2-io2.12 MAVEN version =3.0.0-M7, =3.10-4b5f50b, =0.29.0, =1.0.0, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898,...

ba.sake:hepek-http4s_3 (>=0.31.0 <=0.34.0), ch.linkyard.mcp:jsonrpc2-stdio_3 (>=0.1.0 <=0.3.2) +661 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_3 (>=3.0-117-375521f <=3.12.1)

co.fs2:fs2-io3 MAVEN version =3.0-117-375521f, =0.31.0, =0.1.0, =0.2.0, =0.1.0, =3.10-4b5f50b, =0.29.0, =0.2.1, =1.0.0, =0.1.0, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-377-020cf9e and more Source cves: CVE-2025-58369 Source advisory:...

com.github.pureconfig:pureconfig-fs2_2.11 (>=0.12.1 <=0.14.0), com.github.regis-leray:fs2-ftp_2.11 (>=0.3.0 <=0.5.0) +14 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (>=2.0.1 <=2.1.0)

co.fs2:fs2-io2.11 MAVEN version =2.0.1, =0.12.1, =0.3.0, =3.3.0, =3.0.0, =3.0.0, =3.3.0, =2.0.0, =3.0.0-RC1, =1.2.0, =1.2.5, =1.3.8 and more Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFFJ...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0 <=0.7.0), com.47deg:embedded-cassandra-core_2.12 (=0.0.7) +592 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.12 (>=0.9.2 <=2.5.12)

co.fs2:fs2-io2.12 MAVEN version =0.9.2, =0.3.0, =0.22.0, =0.0.1, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.6.1, =0.6.1, =0.18.1, =0.18.5 - com.avast:datadog4s-http4s2.12 =0.6.0 and more Source cves: CVE-2025-58369 Source advisory: OSV:GHSA-RRW2-PX9J-QFFJ...

FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

GHSA-RRW2-PX9J-QFFJ FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

PT-2025-36633

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

PT-2025-36337

Name of the Vulnerable Software and Affected Versions: fs2 versions 3.12.2 and lower fs2 versions 3.13.0-M1 through 3.13.0-M6 Description: fs2, a compositional, streaming I/O library for Scala, is susceptible to denial of service attacks through TLS sessions when using fs2-io on the JVM with the...

CVE-2022-31183

The CVE-2022-31183 issue affects fs2-io running on Node.js, where server-mode TLSSocket with requestCert = true incorrectly ignores the setting and skips peer certificate verification. Root cause: the Node.js implementation of fs2-io mishandled mTLS, while the JVM TLS path is unaffected. Impact: ...

CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

Authentication Bypass

co.fs2:fs2-io is vulnerable to authentication bypass. A remote attacker is able to skip peer certificate verification, because requestCert = true parameter is ignored when establishing a server-mode TLSSocket on Node.js...

Improper Certificate Validation

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

Node.js 信任管理问题漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A trust management issue vulnerability exists in fs2 on Node.js, which stems from the fact that when fs2-io is used to establish a server-mode TLSSocket on Node.js, it ignores the parameter requestCert = true, skips the...

Improper Certificate Validation

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

co.fs2:fs2-protocols_2.13 (>=3.1-2-8dabe12 <=3.2.10), com.47deg:github4s_2.13 (=0.30.0) +184 more potentially affected by CVE-2022-31183 via co.fs2:fs2-io_2.13 (>=3.1.0 <=3.2-10-421c242)

co.fs2:fs2-io2.13 MAVEN version =3.1.0, =3.1-2-8dabe12, =0.9.0, =0.9.0, =0.3.0, =0.3.0, =0.4.0 and more Source cves: CVE-2022-31183 Source advisory: OSV:GHSA-2CPX-6PQP-WF35...

co.fs2:fs2-protocols_sjs1_2.13 (>=3.1-2-8dabe12 <=3.2.10), com.armanbilge:feral-lambda-api-gateway-proxy-http4s_sjs1_2.13 (>=0.1-2f94f32 <=0.1-f497734) +27 more potentially affected by CVE-2022-31183 via co.fs2:fs2-io_sjs1_2.13 (>=3.1.0 <=3.2-10-421c242)

co.fs2:fs2-iosjs12.13 MAVEN version =3.1.0, =3.1-2-8dabe12, =0.1-2f94f32, =0.1-2f94f32, =0.18.3, =0.18.3, =0.0.5, =0.0.1, =0.1.0, =0.0.1, =6.0.0, =0.23.5, =0.23.5, =1.0.0-M29 and more Source cves: CVE-2022-31183 Source advisory: OSV:GHSA-2CPX-6PQP-WF35...

co.fs2:fs2-protocols_2.12 (>=3.1-2-8dabe12 <=3.2.10), com.47deg:github4s_2.12 (=0.30.0) +146 more potentially affected by CVE-2022-31183 via co.fs2:fs2-io_2.12 (>=3.1.0 <=3.2-10-421c242)

co.fs2:fs2-io2.12 MAVEN version =3.1.0, =3.1-2-8dabe12, =0.9.0, =0.9.0, =0.3.0, =0.3.0, =0.4.0 and more Source cves: CVE-2022-31183 Source advisory: OSV:GHSA-2CPX-6PQP-WF35...