Skip to content
Fencer Vulns
high 7.3

CVE-2024-38355 json

Unhandled 'error' event in socket.io

published 2024-06-19 2 y ago modified 2026-09-24 45 d ago also EUVD-2024-1878 , GHSA-25hc-qcg6-38wj

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Patch / fix

  • npm socket.io 2.5.1, 4.6.2
  • socket socket.io 2.5.1, 4.6.2
  • pgadmin4 SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 8.5-150600.3.6.1

suse advisories SUSE-SU-2024:3771-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-38355 updated cvss 7.3

socket.io: Unhandled 'error' event

  • Red Hat Fuse 7 socket.io Red Hat JBoss Data Grid 7 socket.io
    affected: workaround, no fix planned “It is recommended to update to the latest version to address this vulnerability.”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available “It is recommended to update to the latest version to address this vulnerability.”
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-256-08 updated cvss 7.3

Siemens Industrial Products

  • Siemens AI Model Deployer <V1.1
    affected: fixed in V1.1
  • Siemens Data Flow Monitoring Industrial Edge Device User Interface (DFM IED UI) <V0.0.6
    affected: fixed in V0.0.6 iehub.eu1.edge.siemens.cloud
  • Siemens LiveTwin Industrial Edge app (6AV2170-0BL00-0AA0) <V2.4
    affected: fixed in V2.4
  • Siemens SIMATIC PCS neo V4.1 <V4.1_Update_2
    affected: fixed in V4.1
  • Siemens SIMATIC PCS neo V5.0 <V5.0_Update_1
    affected: fixed in V5.0 support.industry.siemens.com
  • Siemens SIMATIC WinCC Runtime Professional V17
    affected: no fix planned
  • Siemens SIMATIC WinCC Runtime Professional V18 <V18_Update_5
    affected: fixed in V18
  • Siemens SIMATIC WinCC Runtime Professional V19 <V19_Update_3
    affected: fixed in V19
show 4 more
  • Siemens SIMATIC WinCC V7.4
    affected: no fix planned
  • Siemens SIMATIC WinCC V7.5 <V7.5_SP2_Update_18
    affected: fixed in V7.5 support.industry.siemens.com
  • Siemens SIMATIC WinCC V8.0 <V8.0_Update_5
    affected: fixed in V8.0
  • Siemens TIA Administrator <V3.0.3
    affected: fixed in V3.0.3

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm socket.io
<2.5.1
>=3.0.0, <4.6.2
2.5.1
4.6.2

Affected products

  • socketio socket.io
  • socket socket.io

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.