{"id":"CVE-2020-36048","published":"2021-01-07T23:24:33Z","modified":"2024-08-04T17:16:14Z","title":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the…","vendor":null,"product":null,"tier":"tail","description":{"text":"Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03276,"percentile":0.88424,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/socketio/engine.io/commit/734f9d1268840722c41219e69eb58318e0b2ac6b","tags":["x_refsource_MISC"]},{"url":"https://blog.caller.xyz/socketio-engineio-dos/","tags":["x_refsource_MISC"]},{"url":"https://github.com/bcaller/kill-engine-io","tags":["x_refsource_MISC"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":17.68}]},"affected":[{"ecosystem":"npm","package":"engine.io","vulnerableRanges":["<3.6.0"],"patched":["3.6.0"],"from":["GHSA-j4f2-536g-r55m"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1064","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-36048","published":"2021-01-07","fixed":"3.6.0","kev":false},{"cve":"CVE-2022-21676","published":"2022-01-12","fixed":"6.1.1","kev":false},{"cve":"CVE-2022-41940","published":"2022-11-22","fixed":"6.2.1","kev":false,"link":{"from":"CVE-2020-36048","to":"CVE-2022-41940","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:engine.io","fromFixed":"3.6.0","toFixed":"3.6.1","daysApart":684}]}},{"cve":"CVE-2023-31125","published":"2023-05-08","fixed":"6.4.2","kev":false}],"package":"npm:engine.io"}}