CVE-2026-59725

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59725", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.916Z", "datePublished": "2026-07-08T15:37:52.293Z", "dateUpdated": "2026-10-14T18:46:37.137Z"}, "containers": {"cna": {"title": "Socket.IO: Engine.IO Polling Transport Connection Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "lang": "en", "description": "CWE-404: Improper Resource Shutdown or Release", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x"}, {"name": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671"}, {"name": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7"}], "affected": [{"vendor": "socketio", "product": "engine.io", "versions": [{"version": ">= 4.1.0, < 6.6.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-14T18:46:37.137Z"}, "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7."}], "source": {"advisory": "GHSA-r635-g3xr-vw7x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T16:50:45.800976Z", "id": "CVE-2026-59725", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T17:00:32.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:50:45.800976Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:50:49.427Z"}}], "cna": {"title": "Socket.IO: Engine.IO Polling Transport Connection Exhaustion", "source": {"advisory": "GHSA-r635-g3xr-vw7x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "socketio", "product": "engine.io", "versions": [{"status": "affected", "version": ">= 4.1.0, < 6.6.7"}]}], "references": [{"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "name": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "name": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "name": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404: Improper Resource Shutdown or Release"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-14T18:46:37.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59725", "state": "PUBLISHED", "dateUpdated": "2026-10-14T18:46:37.137Z", "dateReserved": "2026-07-06T15:34:16.916Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T15:37:52.293Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "engine.io", "vendor": "socketio", "versions": [{"status": "affected", "version": ">= 4.1.0, < 6.6.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:socket:engine.io:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E891F735-E7C3-41E7-9B17-D0D3D2D6E299", "versionEndExcluding": "6.6.7", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7."}, {"lang": "es", "value": "Socket.IO permite comunicaci\u00f3n bidireccional y de baja latencia para cada plataforma. Desde la versi\u00f3n 4.1.0 anterior a la 6.6.7, el transporte de sondeo del protocolo Engine.IO v4 no cierra correctamente la respuesta HTTP para solicitudes POST binarias no v\u00e1lidas con Content-Type: application/octet-stream, permitiendo a un atacante no autenticado agotar las conexiones y los sockets del lado del servidor. Este problema est\u00e1 solucionado en la versi\u00f3n 6.6.7."}], "id": "CVE-2026-59725", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59725", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T16:50:45.800976Z", "version": "2.0.3"}}]}, "published": "2026-07-08T16:16:33.133", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:37577", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "dotnet8-0-main-8.0.128-1.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-10T00:00:00Z"}], "bugzilla": {"description": "socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests", "id": "2498118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-772", "details": ["Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.", "A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP response from being properly closed, which can lead to the exhaustion of server-side connections and sockets. The primary consequence is a Denial of Service (DoS), making the affected service unavailable to legitimate users."], "name": "CVE-2026-59725", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-07-08T15:37:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59725\nhttps://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671\nhttps://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7\nhttps://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x"], "statement": "This flaw has been rated as Important. An unauthenticated remote attacker can exploit a vulnerability in the Engine.IO protocol v4 polling transport of Socket.IO by sending malformed binary POST requests. This can lead to server-side connection exhaustion and a denial of service, impacting the availability of applications utilizing Socket.IO.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,6.6.7)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "socket.io", "source": "cna", "vendor": "socketio"}, "product": "socket.io", "vendor": "socket"}], "created": "2026-07-09T09:45:04.555892+00:00", "updated": "2026-08-01T16:15:07.332147+00:00", "vendors": ["socket", "socket$PRODUCT$socket.io"]}