CVE-2026-59725 is a denial of service vulnerability in Socket.IO's Engine.IO protocol v4 polling transport. The flaw arises from improper handling of invalid binary POST requests with Content-Type application/octet-stream, which prevents proper closure of HTTP responses. This leads to exhaustion of server-side connections and sockets, resulting in denial of service. The vulnerability affects Red Hat Hardened Images RPMs for dotnet8.0 packages on aarch64 and x86_64 architectures. Red Hat has published a security advisory (RHSA-2026:42986) with updated RPM packages containing bug fixes and enhancements to mitigate this issue.

The vulnerability allows an unauthenticated remote attacker to cause denial of service by exhausting server-side connections and sockets through malformed binary POST requests. This impacts the availability of applications using the affected Socket.IO Engine.IO protocol v4 polling transport. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Red Hat has released updated RPM packages for Red Hat Hardened Images that address this vulnerability. Users should apply the updates as detailed in the Red Hat advisory RHSA-2026:42986. No additional mitigations are specified by the vendor. Patch status is confirmed by the vendor advisory. Refer to https://access.redhat.com/errata/RHSA-2026:42986 for update instructions.