Memory Leak Vulnerability in Python Socket.IO Server by Miguel Grinberg
CVE-2026-48804

7.5HIGH

Key Information:

Vendor

Miguelgrinberg

Status
Python-socketio
Vendor
CVE Published:
11 August 2026

What is CVE-2026-48804?

The vulnerability in the python-socketio occurs when the server retains binary EVENT and ACK messages in memory while waiting for their respective attachments. If an attacker sends a binary message but omits some attachments, the message and its partial list of attachments may linger in memory for an extended time. This can lead to inefficient memory utilization and potential denial-of-service scenarios. The issue has been mitigated in version 5.16.4, where only authenticated clients can submit binary packets, and any partial messages linked to disconnected clients are cleared from memory.

Affected Version(s)

python-socketio < 5.16.4

References

https://github.com/miguelgrinberg/python-socketio/securit...
x_refsource_CONFIRM
https://github.com/miguelgrinberg/python-socketio/commit/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.