Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The fs2-io package (Maven co.fs2 artifacts, Scala 2.12, 2.13 and 3) is vulnerable in versions from 3.0.0-M1 up to 3.12.2 and from 3.13.0-M1 up to 3.13.0-M7, and in versions below 2.5.13. An attacker who can open TCP connections to a TLS server built on fs2-io, such as an ember-based http4s HTTPS server, can half-close a connection during the TLS handshake and make the peer spin on a socket read, consuming a CPU until the connection closes, which enables denial of service. Upgrade to 3.12.2, 3.13.0-M7 or 2.5.13. No workaround is given. Other listed fs2-io artifacts have no fixed version listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0047, the 40th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:09 UTC First seen by agentprime
- 31 Oct 2026, 15:09 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-rrw2-px9j-qffj
- OSV: GHSA-rrw2-px9j-qffj
- github.com/typelevel/fs2/security/advisories/GHSA-rrw2-px9j-qffj
- nvd.nist.gov/vuln/detail/CVE-2025-58369
- github.com/typelevel/fs2/issues/3590
- github.com/typelevel/fs2/pull/3624
- github.com/typelevel/fs2/commit/46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976
- github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c
- github.com/typelevel/fs2/commit/edf0c4f2e660360d1c1a8c5377ce32294de89238
- github.com/typelevel/fs2
- github.com/typelevel/fs2/releases/tag/v3.12.2
- github.com/typelevel/fs2/releases/tag/v3.13.0-M7