CVE-2020-36049

socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

References

Affected packages

Git / github.com/socketio/socket.io-parser

Affected ranges

Type

GIT

Repo

https://github.com/socketio/socket.io-parser

Events

Introduced

Fixed

a8130ce3a9682498bf986a0c3e4a53f9cf2ef965

Fixed

dcb942d24db97162ad16a67c2a0cf30875342d55

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:socket:socket.io-parser:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.4.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "dcb942d24db97162ad16a67c2a0cf30875342d55"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*

2.0.0

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.3.0

2.3.1

2.3.2

3.*

3.0.0

3.1.0

3.1.1

3.1.2

3.1.3

3.2.0

3.3.0

3.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36049.json"