CyberRota Analysis
AI-GeneratedThe Engine.IO protocol in Socket.IO versions 4.1.0 to 6.6.7 is vulnerable to a denial-of-service attack due to improper handling of invalid binary POST requests with the Content-Type set to application/octet-stream, which can lead to server-side connection exhaustion. This vulnerability allows unauthenticated attackers to disrupt service availability. Organizations using affected versions should prioritize upgrading to version 6.6.7 to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.
Related CVEs
Other vulnerabilities affecting the same vendor(s)