Description
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.
Published: 2026-08-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in python-engineio causes the server to load large incoming messages into memory before enforcing the maximum payload size in two specific configurations: POST requests via ASGI with long polling and WebSocket messages via Aiohttp. This resource exhaustion weakness, identified as CWE‑770, can lead to excessive memory consumption, potentially slowing the server or causing it to crash. The consequence is a denial of service that affects a single application instance but can be amplified if the application serves many users.

Affected Systems

The affected software is python‑engineio, maintained by miguelgrinberg. Versions earlier than 4.13.2 are vulnerable; upgrading to 4.13.2 or later applies the fix.

Risk and Exploitability

The CVSS score is 7.5, indicating a high impact. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, implying it is unlikely to be widely exploited at present. However, the attack vector is remote: an adversary can send large requests or WebSocket frames to the vulnerable server from any network location that can reach the service. The vulnerability is exploitable without privileged access, making it a legitimate concern in open or poorly isolated deployments.

Generated by OpenCVE AI on August 12, 2026 at 20:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade python‑engineio to version 4.13.2 or later, which enforces payload size checks before allocating memory.
  • Confirm that the server requires authentication before loading request bodies; adjust your authentication flow if necessary to ensure unauthenticated requests are rejected early.
  • If using Aiohttp, set a maximum WebSocket payload size at the transport layer to discard oversized frames before they reach python‑engineio.

Generated by OpenCVE AI on August 12, 2026 at 20:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m9gh-vj53-gvh9 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Miguelgrinberg
Miguelgrinberg python-engineio
Vendors & Products Miguelgrinberg
Miguelgrinberg python-engineio

Tue, 11 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Description python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.
Title python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Miguelgrinberg Python-engineio
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-11T19:06:21.334Z

Reserved: 2026-05-22T20:57:10.976Z

Link: CVE-2026-48809

cve-icon Vulnrichment

Updated: 2026-08-11T19:06:12.829Z

cve-icon NVD

Status : Received

Published: 2026-08-11T19:17:37.267

Modified: 2026-08-11T20:17:42.717

Link: CVE-2026-48809

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:49:45Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling