CVE-2026-59725

Aliases:GHSA-r635-g3xr-vw7xRHSA-2026:42986CGA-86x7-wm86-p9f4CGA-c6q2-3928-88wwCGA-ffp2-c8hc-555pCGA-rrgp-g2gx-vm9fCGA-x9cw-r5jm-wcrc
Advisory lineage Upstream: 0 Downstream: 1
Downstream
RHSA-2026:37577
Analyzed
Published: 08 Jul 2026, 15:37
Last modified:08 Jul 2026, 17:00

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.64% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Jul 2026, 15:37
Published
Vulnerability first disclosed
08 Jul 2026, 17:00
Last Modified
Vulnerability information updated

Description

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.64%• Percentile: 49%

Techniques & Countermeasures

  • CWE-404•Improper Resource Shutdown or Release

    The product does not release or incorrectly releases a resource before it is made available for re-use.

Affected Systems

  • chainguard•jupyter-base-notebook

    all

  • chainguard•redisinsight

    < 3.8.0-r1

  • chainguard•tensorflow-gpu-jupyter

    < 0

  • wolfi•jupyter-base-notebook

    all

  • Npm•engine.io

    ≥ 4.1.0, < 6.6.7

  • redhat•aspnetcore-runtime-8.0

    < 0:8.0.29-2.hum1

  • redhat•dotnet8.0

    < 0:8.0.129-2.hum1

  • socket•engine.io

    ≥ 4.1.0, < 6.6.7

  • socketio•socket.io

    ≥ 4.1.0, < 6.6.7

References (13)