{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59725", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.916Z", "datePublished": "2026-07-08T15:37:52.293Z", "dateUpdated": "2026-07-08T17:00:32.946Z"}, "containers": {"cna": {"title": "Socket.IO: Engine.IO Polling Transport Connection Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "lang": "en", "description": "CWE-404: Improper Resource Shutdown or Release", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x"}, {"name": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671"}, {"name": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7"}], "affected": [{"vendor": "socketio", "product": "socket.io", "versions": [{"version": ">= 4.1.0, < 6.6.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T15:37:52.293Z"}, "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7."}], "source": {"advisory": "GHSA-r635-g3xr-vw7x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T16:50:45.800976Z", "id": "CVE-2026-59725", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T17:00:32.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:50:45.800976Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:50:49.427Z"}}], "cna": {"title": "Socket.IO: Engine.IO Polling Transport Connection Exhaustion", "source": {"advisory": "GHSA-r635-g3xr-vw7x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "socketio", "product": "socket.io", "versions": [{"status": "affected", "version": ">= 4.1.0, < 6.6.7"}]}], "references": [{"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "name": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "name": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "name": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404: Improper Resource Shutdown or Release"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T15:37:52.293Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59725", "state": "PUBLISHED", "dateUpdated": "2026-07-08T17:00:32.946Z", "dateReserved": "2026-07-06T15:34:16.916Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T15:37:52.293Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{}

{"affected_release": [{"advisory": "RHSA-2026:37577", "cpe": "cpe:/a:redhat:hummingbird:1", "impact": "important", "package": "dotnet8-0-main-8.0.128-1.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-10T00:00:00Z"}], "bugzilla": {"description": "socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests", "id": "2498118", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498118"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-772", "details": ["Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.", "A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP response from being properly closed, which can lead to the exhaustion of server-side connections and sockets. The primary consequence is a Denial of Service (DoS), making the affected service unavailable to legitimate users."], "name": "CVE-2026-59725", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-07-08T15:37:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59725\nhttps://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671\nhttps://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7\nhttps://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x"], "statement": "This flaw has been rated as Important. An unauthenticated remote attacker can exploit a vulnerability in the Engine.IO protocol v4 polling transport of Socket.IO by sending malformed binary POST requests. This can lead to server-side connection exhaustion and a denial of service, impacting the availability of applications utilizing Socket.IO.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,6.6.7)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "socket.io", "source": "cna", "vendor": "socketio"}, "product": "socket.io", "vendor": "socket"}], "created": "2026-07-09T09:45:04.555892+00:00", "updated": "2026-07-26T17:45:17.465776+00:00", "vendors": ["socket", "socket$PRODUCT$socket.io"]}