# CVE-2026-48802: python-engineio denial of service via unbound thread allocation

Source: https://junglewise.ai/threats/cve-2026-48802-python-engineio-denial-of-service-via-unbound-thread-allocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48802 · Severity: high · CVSS 7.5 · Published 2026-08-11

python-engineio is a library used to build real-time communication servers. A vulnerability in its heartbeat mechanism allows an attacker to force the server to create an unlimited number of background threads. This can exhaust server resources, leading to a complete service outage and preventing legitimate users from connecting.

Technologies: [python-engineio (PyPI)](https://junglewise.ai/threats/technologies/python-engineio). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48802 being exploited in the wild.

**How severe is CVE-2026-48802?** High severity, with a CVSS score of 7.5, published 11 August 2026.

**Which products and versions are affected?** python-engineio (PyPI) <= 4.13.1, ECOSYSTEM:introduced=0,fixed=4.13.2.

**Is there a fix for CVE-2026-48802?** Yes. python-engineio (PyPI): upgrade to 4.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48802 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48802?** Check whether you run python-engineio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- python-engineio (PyPI): upgrade to 4.13.2 or later

  ```sh
  pip install "python-engineio>=4.13.2"
  ```


## Technical details

The python-engineio server (specifically synchronous implementations) suffers from a resource exhaustion vulnerability (CWE-770). The heartbeat mechanism incorrectly launches a new background thread both when a new connection is received and whenever a client sends a PONG packet, without verifying if a heartbeat thread is already active for that client. A remote, unauthenticated attacker can exploit this by flooding the server with PONG packets or connection requests to exhaust the host's thread limit or memory. Version 4.13.2 mitigates this by ensuring heartbeat tasks only start after successful authentication and by discarding out-of-sequence PONG packets if a heartbeat thread is already running.

## Affected products

- miguelgrinberg python-engineio <= 4.13.1

## Identifiers

- CVE-2026-48802
- GHSA-cgwc-pv48-fhj5
- PYSEC-2026-3032

## Timeline

- 2026-05-23: disclosed: Initial disclosure to the maintainer
- 2026-06-26: advisory: GitHub Advisory published
- 2026-06-26: patched: Version 4.13.2 released

## References

- [https://api.github.com/users/mauriceng98](https://api.github.com/users/mauriceng98)
- [https://github.com/mauriceng98](https://github.com/mauriceng98)
- [https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D](https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D)
- [https://api.github.com/users/mauriceng98/repos](https://api.github.com/users/mauriceng98/repos)
- [https://avatars.githubusercontent.com/u/97803816?v=4](https://avatars.githubusercontent.com/u/97803816?v=4)
- [https://api.github.com/users/mauriceng98/events%7B/privacy%7D](https://api.github.com/users/mauriceng98/events%7B/privacy%7D)

## Related threats

- [python-engineio denial of service via unchecked payload size](https://junglewise.ai/threats/cve-2026-48809-python-engineio-denial-of-service-via-unchecked-payload-size)
- [python-engineio vulnerable to Cross-Site Request Forgery (CSRF)](https://junglewise.ai/threats/cve-2019-13611-python-engineio-vulnerable-to-cross-site-request-forgery-csrf)