CVE-2025-35435

CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit 89101a6.

More information : https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c