Division by Zero DoS in CISA Thorium

A remote, authenticated attacker can trigger a denial-of-service condition by supplying a stream split size of zero, causing the Thorium service to crash when it performs a division by that value. Based on the provided information, the impact is limited to service disruption and loss of availability; no evidence was provided for code execution, privilege escalation, or data exposure.

As a temporary mitigation, prevent untrusted or lower-trust authenticated users from supplying a stream split size of zero. Add server-side input validation to enforce a non-zero, valid minimum value for the stream split size parameter before processing. Where possible, restrict access to the affected functionality to only trusted authenticated users and monitor for malformed requests that set the split size to zero, as these may indicate exploitation attempts.

Update CISA Thorium to a version that includes the fix introduced in commit 89101a6. If source-based deployment is used, apply or backport that commit. The underlying remediation is to reject or safely handle a stream split size of zero before performing arithmetic operations that use it as a divisor.