{"id":"CVE-2020-36049","published":"2021-01-07T23:24:23Z","modified":"2024-08-04T17:16:14Z","title":"socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet…","vendor":null,"product":null,"tier":"tail","description":{"text":"socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02671,"percentile":0.85742,"provenance":"source"},"cwes":[],"references":[{"url":"https://blog.caller.xyz/socketio-engineio-dos/","tags":["x_refsource_MISC"]},{"url":"https://github.com/bcaller/kill-engine-io","tags":["x_refsource_MISC"]},{"url":"https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55","tags":["x_refsource_MISC"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":17.15}]},"affected":[{"ecosystem":"npm","package":"socket.io-parser","vulnerableRanges":["<3.3.2",">=3.4.0, <3.4.1"],"patched":["3.3.2","3.4.1"],"from":["GHSA-xfhh-g9f5-x4m4"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1424","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-socket-io-parser-cve-2020-36049","children":[{"from":"CVE-2020-36049","to":"CVE-2022-2421","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"3.3.2","toFixed":"3.3.3","daysApart":656},{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55","https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14","https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4"],"basis":"rarely changed file"}]},{"from":"CVE-2020-36049","to":"CVE-2023-32695","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"],"basis":"shared function","functions":["decodeString"]}]}],"packageHistory":[{"cve":"CVE-2020-36049","published":"2021-01-07","fixed":"3.4.1","kev":false},{"cve":"CVE-2022-2421","published":"2022-10-25","fixed":"4.2.1","kev":false},{"cve":"CVE-2023-32695","published":"2023-05-27","fixed":"4.2.3","kev":false},{"cve":"CVE-2026-33151","published":"2026-03-20","fixed":"4.2.6","kev":false}],"package":"npm:socket.io-parser"}}