CVE-2026-48802: python-engineio Denial of Service via Unbound Thread Allocation
Summary
CVE-2026-48802: python-engineio has unbound thread allocation that can cause denial of service. Affects python-engineio versions < 4.13.2. Fixed in 4.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that provides a simple interface for real-time communication between clients and servers using WebSockets. It is widely used in applications that require low-latency communication, such as chat applications and online gaming. The library manages connections and heartbeats to ensure that clients remain connected. However, it is susceptible to a vulnerability that can lead to denial of service due to unbound thread allocation.
Vulnerability Detail
The vulnerability arises from the heartbeat mechanism in python-engineio, which creates a new thread for each new connection and when a client sends a PONG packet. An attacker can exploit this mechanism by sending multiple connections or PONG packets, leading to the creation of excessive background threads. This can overwhelm the server, causing it to become unresponsive. The issue primarily affects synchronous servers, while asynchronous servers are less impacted due to their use of lightweight tasks instead of threads.
How To Fix
Latest published version: 4.14.0 as of 23 Oct 2026
pip install --upgrade "python-engineio==4.14.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.13.2
This is the first release that contains the fix.
pip install --upgrade "python-engineio==4.13.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of connections to your server or implement rate limiting to mitigate the impact of potential attacks until you can apply the patch.
Conclusion
In summary, CVE-2026-48802 is a significant vulnerability in the python-engineio library that can lead to denial of service through unbound thread allocation. It is crucial to update to version 4.13.2 or later to mitigate this risk. Implementing rate limiting can also serve as a temporary workaround while the patch is applied.
See every vulnerability recorded for python-engineio →
FAQ
CVE-2026-48802 is a vulnerability in the python-engineio library that can lead to denial of service due to unbound thread allocation.
If your application uses python-engineio and is running a synchronous server, it may become unresponsive if an attacker exploits this vulnerability by creating excessive threads.
Versions of python-engineio prior to 4.13.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
