Red Hat CVE-2026-33151

Remote unauthenticated attacker can send specially crafted Socket.IO packets with binary attachments to servers running socket.io versions 4.0.0-4.2.5 or 3.4.0-3.4.3. No victim interaction required. Default Socket.IO configurations are vulnerable.

While no CVSS score or EPSS probability is provided, the real-world risk is moderate to high for internet-facing Socket.IO deployments. The vulnerability enables unauthenticated denial of service attacks against the application layer, which can be more impactful than network-layer attacks as they bypass typical DDoS protections. The absence of a CVE entry in CISA KEV suggests no widespread active exploitation has been observed. However, the availability of public patches with specific commit hashes (719f9ebab0772ffb882bd614b387e585c1aa75d4, 9d39f1f080510f036782f2177fac701cc041faaf, b25738c416c4e32fbff62ee182afa8f6d0dacf78) means attackers can reverse-engineer the vulnerability. The attack likely requires low complexity since crafting malicious Socket.IO packets is straightforward for anyone familiar with the protocol. Organizations running public-facing real-time applications (chat, collaboration tools, gaming platforms) using Socket.IO should prioritize patching.

An attacker establishes a Socket.IO connection to a vulnerable server and sends a specially crafted packet declaring an extremely large number of binary attachments (e.g., 1 million attachments). The server allocates memory buffers for each declared attachment and waits for them to arrive, but the attacker never sends the actual attachment data or sends them very slowly. By opening multiple connections and repeating this attack, the attacker exhausts the server's available memory, causing the application to crash or become unresponsive, denying service to legitimate users. The attack requires no authentication and minimal technical sophistication since Socket.IO client libraries can be easily modified to craft malicious packets.