Socket
CVE-2022-25867
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 13 maven packages depend on io.socket:socket.io-client (7 direct, 6 indirect)
Ecosystem-wide dependent count for version 2.0.1.
DescriptionNVD
The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
AnalysisAI
The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Affected products include: Socket Socket.Io-Client Java. Version information: before 2.0.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Soc
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeho
Out-of-bounds heap read in the Perl Socket module before 2.041 lets code that calls pack_ip_mreq_source() with a source
Command injection in Cato Networks Socket (versions prior to 25) enables authenticated administrators with web interface
socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Soc
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today