Catalogo CVE

CVE-2025-61765

python-socketio affected and fixed versions

[Catalogo CVE]

python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications. When Socket.IO servers are configured to use a message queue backend such as Redis for inter-server communication, messages sent between the servers are encoded using the `pickle` Python module. When a server receives one of these messages through the message queue, it assumes it is trusted and immediately deserializes it. The vulnerability stems from deserialization of messages using Python's `pickle.loads()` function. Having previously obtained access to the message queue, the attacker can send a python-socketio server a crafted pickle payload that executes arbitrary code during deserialization via Python's `__reduce__` method. This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable. In addition to making sure standard security practices are followed in the deployment of the message queue, users of the python-socketio package can upgrade to version 5.14.0 or newer, which remove the `pickle` module and use the much safer JSON encoding for inter-server messaging.

Gravità
Medium · CVSS 6.4CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiansidpython-socketio5.16.0-1FixedDistribution-reported fixed boundary[CVE-2025-61765]
Debiansidpython-socketio5.17.0-1Fixed[CVE-2025-61765]
Debianforkypython-socketio5.16.0-1FixedDistribution-reported fixed boundary[CVE-2025-61765]
Debianforkypython-socketio5.17.0-1Fixed[CVE-2025-61765]

Showing 4 fix observations. All 14 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedpython-socketioNot reportedUnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedpython-socketio5.14.0UnknownSource applicability is not established[GHSA-G8C6-8FJJ-2R4M]
Debianbookwormpython-socketioNot reportedAffectedDistribution reports no fix[CVE-2025-61765]
Debianbookwormpython-socketio5.7.2-2Affected[CVE-2025-61765]
Debianforkypython-socketio5.16.0-1FixedDistribution-reported fixed boundary[CVE-2025-61765]
Debianforkypython-socketio5.17.0-1Fixed[CVE-2025-61765]
Debiansidpython-socketio5.16.0-1FixedDistribution-reported fixed boundary[CVE-2025-61765]
Debiansidpython-socketio5.17.0-1Fixed[CVE-2025-61765]
Debiantrixiepython-socketioNot reportedAffectedDistribution reports no fix[CVE-2025-61765]
Debiantrixiepython-socketio5.12.1-1Affected[CVE-2025-61765]
Opensuseleap 15.6python-python-socketio5.7.2-150600.3.3.1UnknownSource applicability is not established[SUSE-SU-2025:3780-1]
Opensusetumbleweedpython-python-socketio5.14.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2025:15613-1]
Suselinux enterprise module for python 3 15 sp6python-python-socketio5.7.2-150600.3.3.1UnknownSource applicability is not established[SUSE-SU-2025:3780-1]
Suselinux enterprise module for python 3 15 sp7python-python-socketio5.7.2-150600.3.3.1UnknownSource applicability is not established[SUSE-SU-2025:3780-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "python-socketio",
      "status": "fixed",
      "release": "sid",
      "version": "5.17.0-1"
    },
    {
      "name": "python-socketio",
      "status": "fixed",
      "release": "forky",
      "version": "5.17.0-1"
    },
    {
      "name": "python-socketio",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.12.1-1"
    },
    {
      "name": "python-socketio",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.7.2-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1117688,
      "name": "python-socketio",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.16.0-1"
    },
    {
      "bug": 1117688,
      "name": "python-socketio",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.16.0-1"
    },
    {
      "bug": 1117688,
      "name": "python-socketio",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1117688,
      "name": "python-socketio",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "python-socketio",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "python-socketio",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.8.0"
            },
            {
              "fixed": "5.14.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "provider_url": "https://osv.dev/vulnerability/GHSA-g8c6-8fjj-2r4m",
      "fixed_version": "5.14.0",
      "provider_source": "pypi",
      "provider_record_id": "GHSA-G8C6-8FJJ-2R4M",
      "provider_updated_at": "2026-09-10T03:50:29.882047738Z",
      "applicability_unknown": true
    },
    {
      "name": "python-python-socketio",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.14.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2025:15613-1",
      "fixed_version": "5.14.1-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2025:15613-1",
      "provider_updated_at": "2026-03-23T04:54:00.465883Z",
      "applicability_unknown": true
    },
    {
      "name": "python-python-socketio",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.7.2-150600.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 3 15 sp6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2025:3780-1",
      "fixed_version": "5.7.2-150600.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2025:3780-1",
      "provider_updated_at": "2026-02-04T02:58:36.037759Z",
      "applicability_unknown": true
    },
    {
      "name": "python-python-socketio",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.7.2-150600.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 3 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2025:3780-1",
      "fixed_version": "5.7.2-150600.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2025:3780-1",
      "provider_updated_at": "2026-02-04T02:58:36.037759Z",
      "applicability_unknown": true
    },
    {
      "name": "python-python-socketio",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.7.2-150600.3.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2025:3780-1",
      "fixed_version": "5.7.2-150600.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2025:3780-1",
      "provider_updated_at": "2026-02-04T02:58:36.037759Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1117688]

Publisher notes

[trixie] python-socketio: Minor issue [bookworm] python-socketio: Minor issue

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

  • [python3-socketio]Sconosciuto

    Pacchetto sorgente: [python-socketio]

    Dettagli (2)

    • 5.7.2-2 · all · bookworm

      Interessata

      dsa · python-socketio · debian · bookworm; dsa · python-socketio · debian · 12

    • 5.7.2-2 · all · bookworm

      Interessata

      dsa · python-socketio · debian · bookworm; dsa · python-socketio · debian · 12

[Debian 13 (Trixie)]

  • [python3-socketio]Sconosciuto

    Pacchetto sorgente: [python-socketio]

    Dettagli (2)

    • 5.12.1-1 · all · trixie

      Interessata

      dsa · python-socketio · debian · 13

    • 5.12.1-1 · all · trixie

      Interessata

      dsa · python-socketio · debian · 13

[openSUSE Tumbleweed]

  • [python313-python-socketio]Sconosciuto

    Pacchetto sorgente: [python-python-socketio]

    Dettagli (1)

    • 5.16.3-1.2 · noarch · tumbleweed

      Sconosciuto · Corretta: 5.14.1-1.1

      Version impact unknown

      dsa · python-python-socketio · opensuse · tumbleweed

  • [python314-python-socketio]Sconosciuto

    Pacchetto sorgente: [python-python-socketio]

    Dettagli (1)

    • 5.16.3-1.2 · noarch · tumbleweed

      Sconosciuto · Corretta: 5.14.1-1.1

      Version impact unknown

      dsa · python-python-socketio · opensuse · tumbleweed

Osservato:

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]