-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| co.fs2:fs2-io | maven | >= 3.1.0, < 3.2.11 | 3.2.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the Node.js server-mode TLSSocket implementation in fs2-io. The pre-patch code in TLSContextPlatform.scala created TLSSockets without:
The commit diff shows the patch added these missing verification steps by using once("secure") and ssl.verifyError(). The vulnerable function is the server socket builder that omitted these critical security checks when requestCert=true was set, making it the root cause of improper certificate validation.