CVE-2026-48809

Received Received - Intake

Memory Exhaustion in python-engineio Server

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-48809

EUVD

EUVD-2026-56854

Affected Vendors & Products

Vendor	Product	Version / Range
python_engineio	python_engineio	to 4.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects python-engineio versions before 4.13.2. It allows attackers to cause unnecessary memory allocations by sending oversized messages in two specific configurations: POST requests using ASGI with long polling transport and WebSocket messages using Aiohttp with WebSocket transport. The issue is patched in version 4.13.2.

Detection Guidance

Check the installed version of python-engineio using pip show python-engineio. If the version is below 4.13.2, the system is vulnerable. Monitor network traffic for unusually large POST requests or WebSocket messages targeting ASGI or Aiohttp services.

Impact Analysis

This vulnerability can lead to a denial of service by consuming excessive server memory, potentially crashing the python-engineio server. It does not require privileges or user interaction to exploit and can impact the availability of services relying on python-engineio.

Compliance Impact

This vulnerability primarily impacts availability by enabling denial-of-service attacks through memory exhaustion. While it does not directly violate GDPR or HIPAA, it could indirectly affect compliance by disrupting services handling personal or health data, potentially leading to downtime or data processing delays that violate availability requirements under these regulations.

Mitigation Strategies

Upgrade python-engineio to version 4.13.2 or later immediately. For ASGI servers, ensure payload size validation is enforced before loading requests into memory. For Aiohttp servers, configure maximum payload size in the WebSocket layer to discard oversized messages.

Hi! I’m here to help you understand CVE-2026-48809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70