CVE-2020-36048

HIGH7.5EPSS 0.50%

Resource exhaustion in engine.io

發布日:2022/2/9修改日:2025/5/29

描述

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

受影響套件(1)

npm/engine.iofrom 0, < 3.6.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-36048
PATCHhttps://github.com/socketio/engine.io
WEBhttps://blog.caller.xyz/socketio-engineio-dos
WEBhttps://github.com/bcaller/kill-engine-io
WEBhttps://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd253703
WEBhttps://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b