Socket.IO Memory Exhaustion Vulnerability via Unbounded Binary Attachments

A denial-of-service vulnerability has been identified in Socket.IO, a real-time communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, the built-in parser allowed an unbounded number of binary attachments in packets. This could be exploited to make the server buffer a large number of binary elements, leading to excessive memory consumption and potential exhaustion of server resources. The issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

Impact

Exploitation of this vulnerability can cause the server to run out of memory, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a Socket.IO packet with a large number of binary attachments. The built-in parser will accept and buffer these attachments, which can be done repeatedly until the server exhausts its memory resources.

Remediation

Users can upgrade to Socket.IO versions 3.3.5, 3.4.4, or 4.2.6 to address this vulnerability.