Denial of Service Vulnerability in Python-EngineIO by Miguel Grinberg
CVE-2026-48802

7.5HIGH

Key Information:

Vendor

Miguelgrinberg

Status
Python-engineio
Vendor
CVE Published:
11 August 2026

What is CVE-2026-48802?

An identified issue within python-engineio allows attackers to exploit the heartbeat mechanism, leading to the creation of unnecessary background threads when a new connection is made and when a PONG packet is received. This situation predominantly affects synchronous servers, potentially risking denial of service. The vulnerability has been addressed in version 4.13.2, which restricts the launching of the initial background thread to authenticated clients and ensures only one active heartbeat thread is maintained per client. Additionally, any out-of-sequence PONG packets are now effectively discarded to prevent further strain on server resources.

Affected Version(s)

python-engineio < 4.13.2

References

https://github.com/miguelgrinberg/python-engineio/securit...
x_refsource_CONFIRM
https://github.com/pypa/advisory-database/tree/main/vulns...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.