CVE-2022-25867

HIGH

Published Aug 2, 20223y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Aug 2, 2022 3y ago

Last Modified Jun 17, 2026 2w ago

Description

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 1

Vendor	Product	Version	Range
socket	socket.io-client_java	*	<2.0.1

References 5

github.com https://github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766b

PatchThird Party Advisory
github.com https://github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284

PatchThird Party Advisory
github.com https://github.com/socketio/socket.io-client-java/issues/508%23issuecomment-1179817361

Third Party Advisory
github.com https://github.com/socketio/socket.io-client-java/releases/tag/socket.io-client-2.0.1

Release NotesThird Party Advisory
security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-IOSOCKET-2949738

ExploitIssue TrackingPatchRelease NotesThird Party Advisory

Remediation

github.com https://github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766b

PatchThird Party Advisory
github.com https://github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284

PatchThird Party Advisory
security.snyk.io https://security.snyk.io/vuln/SNYK-JAVA-IOSOCKET-2949738

ExploitIssue TrackingPatchRelease NotesThird Party Advisory