Read the docs
TI-2026-40502 Aliases CVE-2026-56123GHSA-6r8c-w5mj-43hv

socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size_t, resulting in an unbounded heap write into the 262-byte reply buffer with attacker-controlled size and content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed socat (socat): 1.8.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
socatsocat1.8.0.0 to before 1.8.1.21.8.1.2Patch availableCNA
  • socat Vendorsocat Affected 1.8.0.0 to before 1.8.1.2 Fixed in 1.8.1.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dest-unreach:socat:*:*:*:*:*:*:*:*1.8.0.0 to before 1.8.1.2Vulnerabledest-unreach
  • cpe:2.3:a:dest-unreach:socat:*:*:*:*:*:*:*:* Versions 1.8.0.0 to before 1.8.1.2 Vulnerable ·dest-unreach

Remediation

  • Fix · CNA socat (socat) Fixed in 1.8.1.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 6 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56123
  2. 2026-10-03 Alias added: GHSA-6r8c-w5mj-43hv
  3. 2026-11-01 Affected versions changed · Red Hat

References

Patch 1

  • TI-2004-01360 Format string vulnerability in the _msg function in error.c in socat 1.4.0.3 and earlier… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences