CVE-2022-25867: socket socket.io-client_java NULL Pointer Dereference
CVSS: 7.5v3.1HighModified
AliasesGHSA-85xx-xhjm-rhrw
Published 02-08-2022Last modified 16-09-2024
Vulnerability summary
CVE-2022-25867 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in socket socket.io-client_java. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.65%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 02-08-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:PSourcesAll 3 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.65%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
+0.08 pp
From 1.57% on 19-09-2026
19-09-202619-10-2026
EPSS score1.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (security.snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Io.socket1 product
- socket.io-client< 2.0.1
Socket1 product
- socket.io-client_java< 2.0.1
2 vendors · 2 products
References
7 links- security.snyk.io/vuln/SNYK-JAVA-IOSOCKET-2949738X Refsource MISCWEBExploitIssue TrackingPatchRelease NotesThird Party Advisory
- github.com/socketio/socket.io-client-java/issues/508%23issuecomment-1179817361X Refsource MISCWEBThird Party Advisory
- github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284X Refsource MISCWEBPatchThird Party Advisory
- github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766bX Refsource MISCWEBPatchThird Party Advisory
- github.com/socketio/socket.io-client-java/releases/tag/socket.io-client-2.0.1X Refsource MISCWEBRelease NotesThird Party Advisory
