TI-2026-36072 Aliases CVE-2026-48802 GHSA-cgwc-pv48-fhj5

python-engineio has unbound thread allocation that can cause denial of service

MEDIUM 40CWE-770Published 2026-08-11 · Updated 2026-08-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers. Asynchronous servers allocate background tasks instead of physical threads, which are lightweight and less likely to cause denial of service. However, the fix that was implemented was also applied to the asynchronous case. Version 4.13.2 addresses this issue as follows: The initial background thread (or async task( for heartbeat management is only launched if a client passes authentication in the `connect` handler; and the server now ensures that there is only one background heatbeat thread (or async task) per client at a given point in time. Out of sequence PONG packets are now discarded when an active heartbeat thread is already running.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00575 47th percentileScored 2026-11-07

Fix Fixed python-engineio (miguelgrinberg): 4.13.2python-engineio (PyPI): 4.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
miguelgrinberg	python-engineio	before 4.13.2	4.13.2	Patch available	CNA
—	python-engineio (PyPI)	before 4.13.2	4.13.2	Patch available	GHSA-cgwc-pv48-fhj5

python-engineio Vendormiguelgrinberg Affected before 4.13.2 Fixed in 4.13.2 Patch available CNA
python-engineio (PyPI) Vendor— Affected before 4.13.2 Fixed in 4.13.2 Patch available GHSA-cgwc-pv48-fhj5

Remediation

Fix · CNA python-engineio (miguelgrinberg) Fixed in 4.13.2
Fix · GHSA-cgwc-pv48-fhj5 python-engineio (PyPI) Fixed in 4.13.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-48802
2026-10-03 Alias added: GHSA-cgwc-pv48-fhj5

References

Other 3

TI-2026-36078 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced CVSS 3.1HIGH 7.5
TI-2026-36073 python-socketio: Binary attachment accumulation can cause denial of service CVSS 3.1HIGH 7.5
TI-2026-26780 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client CVSS 3.1HIGH 8.2
TI-2025-38159 Deserialization of untrusted data in miguelgrinberg python-socketio CVSS 3.1MEDIUM 6.4
TI-2026-31080 Microdot: HTTP response splitting in Response.set_cookie() CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences