Memory Allocation Vulnerability in Python Engine.IO Client and Server by Miguel Grinberg

CVE-2026-48809

What is CVE-2026-48809?

The python-engineio package, an implementation for Engine.IO real-time communication, has a vulnerability that allows an attacker to cause excessive memory allocations through specific POST requests and WebSocket messages. In versions prior to 4.13.2, the size of incoming messages was not validated before being loaded into memory, which could lead to system resource exhaustion. The new version enhances security by only permitting the loading of request bodies after confirming client authentication and ensuring that the payload size is within acceptable limits. This update also applies to Aiohttp, where maximum payload sizes are managed to prevent oversized messages from being delivered to the python-engineio server.

References