Socket.IO's Engine.IO protocol v4 polling transport handles binary POST requests with Content-Type: application/octet-stream. In versions 4.1.0 through 6.6.6, the server fails to close the HTTP response for invalid binary requests, keeping the connection open and consuming socket resources. This flaw demonstrates resource shutdown failure (CWE‑404) and improper resource management (CWE‑772). The attacker can exploit this without authentication to exhaust the server's ability to accept new connections, leading to a denial‑of‑service situation.

Socket.IO clients and servers from version 4.1.0 up to, but not including, 6.6.7 are impacted. The Issue also applies to installations of Red Hat Hummingbird 1 that incorporate the affected Socket.IO component.

The CVSS score of 7.5 indicates a high severity vulnerability that can cause service disruption. The EPSS score of < 1% suggests that the probability of exploitation is low, although the flaw can be triggered remotely by sending crafted HTTP POST requests. The vulnerability is not present in the CISA KEV catalog. An attacker can repeatedly send malformed binary POST requests to exhaust server connections and sockets, forcing legitimate clients to be denied service.