CVE-2025-35435: Cisa Thorium

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit 89101a6.

Affected products

• Cisa Thorium: up to and including 1.1.2

Published 2025-09-17. Last modified 2026-06-17.