logo

Database

Asymmetric denial of service In engine.io

Description

Resource exhaustion in engine.io Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-360482. NVD-2020-360483. OSV-2020-360484. GCVE-2020-36048

References

1. https://github.com/socketio/engine.io/commit/58e274c437e9cbcf69fd913c813aad8fbd2537032. https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b3. https://blog.caller.xyz/socketio-engineio-dos4. https://github.com/bcaller/kill-engine-io

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.