Executive brief
A vulnerability in the python-engineio library, which handles real-time communication for web applications, could allow an attacker to crash the server. By sending specially crafted large messages, an attacker can force the server to consume excessive memory, leading to a denial of service. This affects applications using specific configurations like ASGI long polling or Aiohttp WebSockets.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in python-engineio where incoming message sizes are not validated before being loaded into memory. This occurs in two specific scenarios: POST requests using the ASGI long polling transport, and WebSocket messages using the Aiohttp transport. A remote, unauthenticated attacker can exploit this by sending payloads exceeding intended limits, leading to a Denial of Service (DoS) via memory exhaustion. The issue is addressed in version 4.13.2 by implementing size checks before memory allocation in ASGI and leveraging Aiohttp's native WebSocket payload limits.
Affected products
- miguelgrinberg python-engineio <= 4.13.1
Timeline
- 2026-05-23: disclosed
- 2026-06-26: advisory: GitHub Advisory published/reviewed
- 2026-06-26: patched: Version 4.13.2 released