Read the docs
TI-2026-36078 Aliases CVE-2026-48809GHSA-m9gh-vj53-gvh9

python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

Priority LOW 39CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed python-engineio (miguelgrinberg): 4.13.2python-engineio (PyPI): 4.13.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
miguelgrinbergpython-engineiobefore 4.13.24.13.2Patch availableCNA
—python-engineio (PyPI)before 4.13.24.13.2Patch availableGHSA-m9gh-vj53-gvh9
  • python-engineio Vendormiguelgrinberg Affected before 4.13.2 Fixed in 4.13.2 Patch available CNA
  • python-engineio (PyPI) Vendor— Affected before 4.13.2 Fixed in 4.13.2 Patch available GHSA-m9gh-vj53-gvh9

Remediation

  • Fix · CNA python-engineio (miguelgrinberg) Fixed in 4.13.2
  • Fix · GHSA-m9gh-vj53-gvh9 python-engineio (PyPI) Fixed in 4.13.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48809
  2. 2026-10-03 Alias added: GHSA-m9gh-vj53-gvh9

References

Other 3

  • TI-2026-36072 python-engineio has unbound thread allocation that can cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-36073 python-socketio: Binary attachment accumulation can cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-26780 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client CVSS 3.1HIGH 8.2
  • TI-2025-38159 Deserialization of untrusted data in miguelgrinberg python-socketio CVSS 3.1MEDIUM 6.4
  • TI-2026-31080 Microdot: HTTP response splitting in Response.set_cookie() CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences