CVE-2026-48804

Received Received - Intake

Memory Leak in python-socketio Due to Unreleased Binary Messages

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48804

EUVD

EUVD-2026-56894

Affected Vendors & Products

Vendor	Product	Version / Range
miguelgrinberg	python_socketio	to 5.16.3 (inc)
miguelgrinberg	python_socketio	5.16.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects python-socketio, a Python implementation of Socket.IO. It allows an attacker to send a binary message without its attachments, causing the server to retain the partial message and received attachments in memory indefinitely. This leads to memory exhaustion and denial of service.

Detection Guidance

Monitor memory usage of the python-socketio process for unusual increases. Check for incomplete binary packets in the _binary_packet dictionary using server logs or debugging tools. Look for clients that disconnect without sending all attachments.

Impact Analysis

The vulnerability can cause denial of service by consuming server memory, leading to degraded performance or crashes. It requires no authentication or user interaction, making it exploitable remotely over a network.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires maintaining system availability, while HIPAA mandates safeguards against disruptions. The memory exhaustion from unprocessed binary messages could lead to service degradation or outages, violating availability requirements.

Mitigation Strategies

Upgrade python-socketio to version 5.16.4 or later. Ensure only authenticated clients can send binary packets. Monitor server memory usage and restart processes if memory usage spikes unexpectedly.

Hi! I’m here to help you understand CVE-2026-48804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70