The vulnerability resides in the way the python-socketio server processes binary messages. When a binary EVENT or ACK packet is received, the server holds it in memory until all its attachments are delivered. Prior to version 5.16.4 an attacker can send a binary packet and then fail to send one or more of its required attachments, causing the incomplete message to remain in memory indefinitely. As the message stays resident, the process consumes more and more memory, potentially exhausting available resources and resulting in a denial of service. This is a resource exhaustion weakness identified as CWE‑770.

All installations of miguelgrinberg:python-socketio version 5.16.3 and earlier are affected. The issue was fixed in release 5.16.4, which validates that binary packets come only from authenticated clients and deletes any partial message when a client disconnects.

The reported CVSS score is 7.5, which places the vulnerability in the high severity range. The EPSS score is below 1%, indicating that exploitation attempts are currently expected to be rare, and it is not listed in the CISA KEV catalog. The attack would be carried out via the network, requiring an existing client connection to the server that can send binary packets. Because the flaw is triggered by crafting a message with missing attachments, the exploitation path is straightforward for an attacker who can inject packets, but the overall probability of finding an exploitable target remains low. Still, the potential impact on service availability warrants timely remediation.