CVE-2026-48804: python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and

Executive brief

A vulnerability in the python-socketio library can allow an attacker to crash or slow down a server by exhausting its memory. The library incorrectly stores partial data from incoming messages indefinitely if the sender never finishes sending the message. This can lead to a denial-of-service condition, making the application unavailable to legitimate users.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in python-socketio versions 5.16.1 and earlier. The server-side implementation stores binary EVENT and ACK messages in memory while awaiting their corresponding binary attachments. An attacker can exploit this by initiating a binary message transfer and intentionally withholding one or more attachments, causing the partial message and received attachments to persist in memory indefinitely. This can be performed without authentication in vulnerable versions. The fix in version 5.16.2 restricts binary packets to authenticated clients and ensures partial messages are purged upon client disconnection.

Affected products

• miguelgrinberg python-socketio <= 5.16.1

Timeline

• 2026-05-23: disclosed: Vulnerability reported to maintainer
• 2026-06-26: advisory: GitHub Advisory published

References

• https://api.github.com/users/mauriceng98
• https://github.com/mauriceng98
• https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D
• https://api.github.com/users/mauriceng98/repos
• https://avatars.githubusercontent.com/u/97803816?v=4
• https://api.github.com/users/mauriceng98/events%7B/privacy%7D