Name: CVE-2024-38355: Improper Input Validation
Creator: Rapid7
Published: 2024-06-19T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2024-38355, CVSS 7.3, EPSS 0.00136

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `[email protected]` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

CVSS Details

CVSS 3.1 Base Score: 7.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Suse	—	Upgrade system-user-pgadminUpgrade pgadmin4-desktopUpgrade pgadmin4-web-uwsgiUpgrade pgadmin4-cloudUpgrade pgadmin4Upgrade pgadmin4-doc	Dec 5, 2025	Oct 29, 2024

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence