socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests

🗓️ 10 Jul 2026 05:14:22Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 6 Views

Socket.IO DoS via Engine.IO v4 polling: unauthenticated invalid binary POSTs exhaust server resources.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-59725	8 Jul 202615:37	–	attackerkb
CVE	CVE-2026-59725	8 Jul 202615:37	–	cve
Cvelist	CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion	8 Jul 202615:37	–	cvelist
EUVD	EUVD-2026-42313	8 Jul 202615:37	–	euvd
NVD	CVE-2026-59725	8 Jul 202616:16	–	nvd
OSV	CVE-2026-59725 Socket.IO: Engine.IO Polling Transport Connection Exhaustion	8 Jul 202615:37	–	osv
OSV	RHSA-2026:37577 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	11 Jul 202610:05	–	osv
Positive Technologies	PT-2026-56488	8 Jul 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-59725	10 Jul 202610:19	–	redhatcve
RedHat Linux	Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	10 Jul 202605:14	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	aspnetcore-runtime-8.0	8.0.28-1.1.hum1	aspnetcore-runtime-8.0-8.0.28-1.1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	aspnetcore-runtime-8.0	8.0.28-1.1.hum1	aspnetcore-runtime-8.0-8.0.28-1.1.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-59725
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671
github	www.github.com/socketio/socket.io/releases/tag/[email protected]
github	www.github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59725
cve	www.cve.org/CVERecord

17 Jul 2026 14:00Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00354

SSVC

denial of service invalid binary post engine io protocol polling transport content type octet stream