CVE-2025-35435
📋 TL;DR
CVE-2025-35435 is a division-by-zero vulnerability in CISA Thorium that allows authenticated remote attackers to crash the service by sending a stream split size of zero. This affects systems running vulnerable versions of Thorium before the fix. The vulnerability requires authentication but could cause denial of service.
💻 Affected Systems
- CISA Thorium
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Service crashes leading to denial of service, potentially disrupting critical monitoring or security functions if Thorium is part of security infrastructure.
Likely Case
Authenticated attacker causes service interruption, requiring restart of Thorium service to restore functionality.
If Mitigated
With proper authentication controls and network segmentation, impact is limited to denial of service within the authenticated user's scope.
🎯 Exploit Status
Requires authenticated access to Thorium service and knowledge of how to trigger stream split functionality with zero value.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 89101a6 or later
Vendor Advisory: https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c
Restart Required: No
Instructions:
1. Update Thorium to commit 89101a6 or later. 2. Pull latest changes from repository. 3. Rebuild and redeploy Thorium service.
🔧 Temporary Workarounds
Input validation at proxy/load balancer
allBlock requests containing stream split size of zero at network boundary
Restrict authenticated access
allLimit Thorium access to only necessary authenticated users
🧯 If You Can't Patch
- Implement network segmentation to isolate Thorium from untrusted networks
- Monitor for service crashes and implement automated restart procedures
🔍 How to Verify
Check if Vulnerable:
Check Thorium version/git commit hash - if before commit 89101a6, system is vulnerable.Check Version:
git log --oneline -1Verify Fix Applied:
Verify Thorium is running commit 89101a6 or later and test stream split functionality with various inputs.📡 Detection & Monitoring
Log Indicators:
- Thorium service crash logs
- Division by zero errors in application logs
- Unexpected service restarts
Network Indicators:
- Unusual authenticated requests to Thorium stream endpoints
- Requests with zero-value parameters
SIEM Query:
source="thorium" AND ("division by zero" OR "crash" OR "segfault")