CVE-2026-48802: python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the c

Executive brief

python-engineio is a library used to build real-time communication servers. A vulnerability in its heartbeat mechanism allows an attacker to force the server to create an unlimited number of background threads. This can exhaust server resources, leading to a complete service outage and preventing legitimate users from connecting.

Technical details

The python-engineio server (specifically synchronous implementations) suffers from a resource exhaustion vulnerability (CWE-770). The heartbeat mechanism incorrectly launches a new background thread both when a new connection is received and whenever a client sends a PONG packet, without verifying if a heartbeat thread is already active for that client. A remote, unauthenticated attacker can exploit this by flooding the server with PONG packets or connection requests to exhaust the host's thread limit or memory. Version 4.13.2 mitigates this by ensuring heartbeat tasks only start after successful authentication and by discarding out-of-sequence PONG packets if a heartbeat thread is already running.

Affected products

• miguelgrinberg python-engineio <= 4.13.1

Timeline

• 2026-05-23: disclosed: Initial disclosure to the maintainer
• 2026-06-26: advisory: GitHub Advisory published
• 2026-06-26: patched: Version 4.13.2 released

References

• https://api.github.com/users/mauriceng98
• https://github.com/mauriceng98
• https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D
• https://api.github.com/users/mauriceng98/repos
• https://avatars.githubusercontent.com/u/97803816?v=4
• https://api.github.com/users/mauriceng98/events%7B/privacy%7D