CVE-2025-61765_PoC

概要 python-socketio のバージョン 5.14.0 より前のリモートコード実行の脆弱性により、攻撃者が悪意のある pickle のデシリアライズを通じて任意の Python コードを実行できる可能性があります。これは、攻撃者がサーバー間の内部通信に使用されるメッセージキューへのアクセスを事前に得たマルチサーバー展開に影響します。 この脆弱性の詳細な分析は GitHub Advisory でご覧いただけます。 実行 このデモには3つのDockerコンテナが関与しています: 1. Redis Server : メッセージブローカーとして機能します。 2. Vulnerable...

ROOT-APP-NPM-CVE-2024-38355 CVE-2024-38355 in socket.io - Patched by Root

Root has patched CVE-2024-38355 in the socket.io package for Root:npm. Multiple fixed versions available...

CVE-2026-48804

A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-48804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-socketio is a Python implementation of the Socket.IO realtime client and server. The python- socketio server stores binary EVENT and ACK messages in memo...

CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

DEBIAN-CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

UBUNTU-CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-48804

CVE-2026-48804 affects the Python Socket.IO server implementation in python-socketio. The issue: the server stores binary EVENT and ACK messages in memory while waiting for missing attachments, allowing an attacker to submit a binary message and omit attachments, causing the message and partial a...

CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-48804 python-socketio: Binary attachment accumulation can cause denial of service

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-48804 python-socketio: Binary attachment accumulation can cause denial of service

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

EUVD-2026-56894

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to...

CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

CVE-2026-69185

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

Malicious code in soccketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc9cac2969243ba864ef1645d5d99ed62e8e4906bc58cd32cee3fad42c9c528 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-68502 LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

SUSE SLED15 / SLES15 Security Update : python-python-socketio (SUSE-SU-2026:3086-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3086-1 advisory. - CVE-2026-48804: Binary attachment accumulation can cause denial of service bsc1269491. Tenable has extracted the...

SUSE-SU-2026:3086-1 Security update for python-python-socketio

This update for python-python-socketio fixes the following issues: - CVE-2026-48804: Binary attachment accumulation can cause denial of service bsc1269491...

PYSEC-2026-3042 python-socketio: Binary attachment accumulation can cause denial of service

Impact The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its...