critical
CVE-2026-56123
socat: Socat: Heap-based buffer overflow allows arbitrary code execution via malicious SOCKS5 proxy server
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Ubuntu (medium).
Description
socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size_t, resulting in an unbounded heap write into the 262-byte reply buffer with attacker-controlled size and content.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.21 | socat | 1.8.1.2-r0 |
| alpine 3.22 | socat | 1.8.1.2-r0 |
| alpine 3.23 | socat | 1.8.1.2-r0 |
| alpine 3.24 | socat | 1.8.1.2-r0 |
| alpine edge | socat | 1.8.1.2-r0 |
| debian 13 | socat | 1.8.0.3-1+deb13u1 |
| debian 14 | socat | 1.8.1.3-1 |
| echo | socat | 1.8.1.3-1 |
| rapidfort alpine 3.20 | socat | 1.8.0.3-r0 |
| rapidfort alpine 3.23 | socat | 1.8.0.3-r0 |
| rapidfort debian 12 | socat | 0:1.8.0.3-1+deb13u1, 0:1.8.1.3-1 |
| rapidfort debian 13 | socat | 0:1.8.0.3-1+deb13u1, 0:1.8.1.3-1 |
Show all 21 entries from 18 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.21 | socat | 1.8.1.2-r0 |
| alpine 3.22 | socat | 1.8.1.2-r0 |
| alpine 3.23 | socat | 1.8.1.2-r0 |
| alpine 3.24 | socat | 1.8.1.2-r0 |
| alpine edge | socat | 1.8.1.2-r0 |
| debian 13 | socat | 1.8.0.3-1+deb13u1 |
| debian 14 | socat | 1.8.1.3-1 |
| echo | socat | 1.8.1.3-1 |
| rapidfort alpine 3.20 | socat | 1.8.0.3-r0 |
| rapidfort alpine 3.23 | socat | 1.8.0.3-r0 |
| rapidfort debian 12 | socat | 0:1.8.0.3-1+deb13u1, 0:1.8.1.3-1 |
| rapidfort debian 13 | socat | 0:1.8.0.3-1+deb13u1, 0:1.8.1.3-1 |
| rapidfort fedora 43 | socat | 1.8.1.3-1.fc43 |
| rapidfort ubuntu 20.04 | rf-socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| rapidfort ubuntu 20.04 | socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | rf-socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | rf-socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | socat | 0:1.8.0.0-4ubuntu0.1, 0:1.8.1.1-1ubuntu0.1 |
| ubuntu 24.04 | socat | 1.8.0.0-4ubuntu0.1 |
| ubuntu 26.04 | socat | 1.8.1.1-1ubuntu0.1 |
References
- http://www.dest-unreach.org/socat/CHANGES
- http://www.dest-unreach.org/socat/contrib/socat-secadv10.html
- https://access.redhat.com/security/cve/CVE-2026-56123
- https://nvd.nist.gov/vuln/detail/CVE-2026-56123
- https://ubuntu.com/security/notices/USN-8511-1
- https://www.cve.org/CVERecord?id=CVE-2026-56123
- https://www.vulncheck.com/advisories/socat-heap-buffer-overflow-via-socks5-reply-parser