Advisories for Maven/Co.fs2/Fs2-Io_2.12.0-RC1 package

2025

FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed. This could be used as a denial of service attack …