What’s Vulnerable › Vulnerabilities

CVE-2022-21667: Denial of Service in soketi

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-10 · updated 2026-06-17
• Weakness: CWE-755

Description

soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the latest patch. There are no workarounds for this issue.

Affected products

• soketi: before 0.24.1 — fixed in 0.24.1

How to fix

Upgrade to a fixed version: soketi 0.24.1. Check the vendor advisory for mitigations.

References

• https://github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b
• https://github.com/soketi/soketi/releases/tag/0.24.1
• https://github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf
• https://github.com/soketi/soketi/commit/4b12efef9c31117c36a0a0f1c3aa32114e86364b
• https://github.com/soketi/soketi/releases/tag/0.24.1
• https://github.com/soketi/soketi/security/advisories/GHSA-86ch-6w7v-v6xf

Get alerted when CVE-2022-21667 or the next vulnerability affects your stack