CVE-2026-33151
highPriorität · verfolgen · 30EPSS 0.007 · 51. PerzentilDEEURUUSEPSS · bewertet 2026-10-22
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSentio Creatorsick_psirt
Users are strongly recommended to upgrade the Software Deployment Manager extension for Sentio Creator to version 0.14.0.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–8.7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (44)
Betroffene Produkte und Versionsbereiche.
- IBM App Connect Enterprise 12.0.1.0-12.0.12.25alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.25
- IBM App Connect Enterprise 12.0.1.0-12.0.12.26alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.26
- IBM App Connect Enterprise 13.0.1.0-13.0.7.0alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.7.0
- IBM App Connect Enterprise 13.0.1.0-13.0.7.1alle Versionencert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.7.1
- IBM SPSS Collaboration and Deployment Servicesalle Versionencert_bundDEcpe:/a:ibm:spss:collaboration_and_deployment_services
- IBM Sterling Connect:Direct Web Servicesalle Versionencert_bundDEcpe:/a:ibm:sterling_connect%3adirect:web_services
- Red Hat Enterprise Linux 9 Multicluster Engine for Kubernetes 2.8.6alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:9_multicluster_engine_for_kubernetes_2.8.6
- Red Hat OpenShift OpenShift Container Platform 4.20.29alle Versionencert_bundDEcpe:/a:redhat:openshift:openshift_container_platform_4.20.29
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SCA-2026-0008Vulnerability Affecting SICK Sentio Creator Extension “Software Deployment Manager”2026-07-10csaf · sick_psirtDE
The pre-installed Software Deployment Manager extension in SICK Sentio Creator is affected by CVE-2026-33151. The Software Deployment Manager extension is maintained and updated independently from SICK Sentio Creator and therefore SICK recommends applying the defined remediations for the vulnerability.
- WID-SEC-W-2026-1407IBM App Connect Enterprise Certified Container: Mehrere SchwachstellenDeutsch2026-05-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- GHSA-677m-j7p3-52f9socket.io allows an unbounded number of binary attachments2026-03-18ghsa · osvUS
### Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. ### Patches | Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` | | `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` | | `<3.3.5` | `socket.io-client@2.x` | `3.3.5` | ### Workarounds There is no known workaround except upgrading to a safe version. ### For more information If you have any questions or comments about this advisory: - Open a discussion [here](https://github.com/socketio/socket.io/discussions)
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (14)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2026-33151cnnvd
- https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4cnnvd
- https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faafcnnvd
- https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78cnnvd
- https://github.com/socketio/socket.io/releasesPatchcnnvd
- https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9cnnvd
- https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4enisa_euvd
- https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faafenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan