CVE-2026-56123 is a high severity (CVSS 8.1) heap based buffer overflow in socat 1.8.0.0 through 1.8.1.1. A malicious SOCKS5 proxy server can trigger it in the client. The socat changelog lists the fix in version 1.8.1.2, so upgrade to that or a later release.
What's affected
The record lists socat versions 1.8.0.0 through 1.8.1.1. The socat changelog places the fix in 1.8.1.2 and adds a regression test, which 1.8.1.3 corrects. Take 1.8.1.3 or later if you can.
The changelog also narrows the exposure. It says only builds where the C char type is signed are affected, and that the problem is reached by connecting to a malicious SOCKS5 server. So the risk applies when socat is the SOCKS5 client and you point it at a proxy you do not control or trust.
The CVSS vector has high attack complexity, which matches that narrow condition.
How to check if you're exposed
Check the version and how you use socat.
socat -V
- A version from 1.8.0.0 through 1.8.1.1 is in scope.
- Search scripts, systemd units and container entrypoints for socat commands that use the SOCKS5 address type. Those are the only uses that reach the vulnerable code.
- On Linux distributions, check the package changelog, because vendors often backport fixes without changing the upstream version number.
What to do now
- Upgrade socat to 1.8.1.3 or later, or install your distribution's patched package.
- Find scripts and services that connect through a SOCKS5 proxy with socat, and confirm each proxy is one you operate or trust.
- Rebuild container images that bundle socat, then redeploy them.
- If you cannot upgrade yet, stop using socat's SOCKS5 client against untrusted proxies.
Why it matters
The weakness is CWE-122, a heap based buffer overflow. The advisory describes a sign extension error: a length byte is read through a signed field, a large value turns negative, and the later conversion to an unsigned size makes the number huge. The program then copies far more data into a 262 byte reply buffer than it can hold.
This is a good example of how a small type mismatch becomes a memory safety bug. It is also a reminder that the dangerous side of a proxy relationship can be the proxy, not the client. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I never use SOCKS5?
The changelog ties the issue to the SOCKS5 client code, so uses of socat without it do not reach the flaw. Upgrade anyway, since the release also includes other fixes.
Sources
Last reviewed: 19 October 2026.
