Is CVE-2026-48802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48802 being exploited in the wild.

How severe is CVE-2026-48802?

High severity, with a CVSS score of 7.5, published 11 August 2026.

Which products and versions are affected?

python-engineio (PyPI) <= 4.13.1, ECOSYSTEM:introduced=0,fixed=4.13.2.

Is there a fix for CVE-2026-48802?

Yes. python-engineio (PyPI): upgrade to 4.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48802 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48802?

Check whether you run python-engineio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48802: python-engineio denial of service via unbound thread allocation

Q: Is there a fix for CVE-2026-48802?

Yes. python-engineio (PyPI): upgrade to 4.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48802 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48802?

Check whether you run python-engineio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48802 · Severity: high · CVSS 7.5 · Published 2026-08-11

python-engineio is a library used to build real-time communication servers. A vulnerability in its heartbeat mechanism allows an attacker to force the server to create an unlimited number of background threads. This can exhaust server resources, leading to a complete service outage and preventing legitimate users from connecting.

Technologies: python-engineio (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48802 being exploited in the wild.
How severe is CVE-2026-48802?: High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?: python-engineio (PyPI) <= 4.13.1, ECOSYSTEM:introduced=0,fixed=4.13.2.
Is there a fix for CVE-2026-48802?: Yes. python-engineio (PyPI): upgrade to 4.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48802 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48802?: Check whether you run python-engineio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

python-engineio (PyPI): upgrade to 4.13.2 or later
```
pip install "python-engineio>=4.13.2"
```

Technical details

The python-engineio server (specifically synchronous implementations) suffers from a resource exhaustion vulnerability (CWE-770). The heartbeat mechanism incorrectly launches a new background thread both when a new connection is received and whenever a client sends a PONG packet, without verifying if a heartbeat thread is already active for that client. A remote, unauthenticated attacker can exploit this by flooding the server with PONG packets or connection requests to exhaust the host's thread limit or memory. Version 4.13.2 mitigates this by ensuring heartbeat tasks only start after successful authentication and by discarding out-of-sequence PONG packets if a heartbeat thread is already running.

Affected products

miguelgrinberg python-engineio <= 4.13.1

Identifiers

CVE-2026-48802
GHSA-cgwc-pv48-fhj5
PYSEC-2026-3032

Timeline

2026-05-23: disclosed: Initial disclosure to the maintainer
2026-06-26: advisory: GitHub Advisory published
2026-06-26: patched: Version 4.13.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.