Read the docs
TI-2026-36073 Aliases CVE-2026-48804GHSA-5w7q-77mv-v69f

python-socketio: Binary attachment accumulation can cause denial of service

Priority LOW 39CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed python-socketio (miguelgrinberg): 5.16.4python-socketio (PyPI): 5.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
miguelgrinbergpython-socketiobefore 5.16.45.16.4Patch availableCNA
—python-socketio (PyPI)before 5.16.25.16.2Patch availableGHSA-5w7q-77mv-v69f
  • python-socketio Vendormiguelgrinberg Affected before 5.16.4 Fixed in 5.16.4 Patch available CNA
  • python-socketio (PyPI) Vendor— Affected before 5.16.2 Fixed in 5.16.2 Patch available GHSA-5w7q-77mv-v69f

Remediation

  • Fix · CNA python-socketio (miguelgrinberg) Fixed in 5.16.4
  • Fix · GHSA-5w7q-77mv-v69f python-socketio (PyPI) Fixed in 5.16.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48804
  2. 2026-10-03 Alias added: GHSA-5w7q-77mv-v69f

References

Other 3

  • TI-2026-36072 python-engineio has unbound thread allocation that can cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-36078 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced CVSS 3.1HIGH 7.5
  • TI-2026-26780 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client CVSS 3.1HIGH 8.2
  • TI-2025-38159 Deserialization of untrusted data in miguelgrinberg python-socketio CVSS 3.1MEDIUM 6.4
  • TI-2026-31080 Microdot: HTTP response splitting in Response.set_cookie() CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences