CVE-2026-48809: python-engineio Denial of Service Due to Unchecked Payload Size
Summary
CVE-2026-48809: python-engineio has possible denial of service due to maximum payload size sometimes not being enforced. Affects python-engineio versions < 4.13.2. Fixed in 4.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-engineio is a Python library that facilitates real-time communication between clients and servers using WebSockets and other transport methods. It is widely used in web applications to enable features like live chat, notifications, and real-time updates. However, certain configurations of python-engineio have been found to be vulnerable to denial of service attacks due to improper handling of incoming message sizes.
Vulnerability Detail
The vulnerability arises from two specific configurations of the python-engineio server where the size of incoming messages is not verified before being loaded into memory. This oversight can lead to excessive memory allocation, allowing an attacker to exploit the server by sending large payloads. The affected scenarios include POST requests using ASGI with long polling transport and WebSocket messages using Aiohttp. If exploited, this vulnerability can lead to service disruptions and degraded performance.
How To Fix
Latest published version: 4.14.0 as of 23 Oct 2026
pip install --upgrade "python-engineio==4.14.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.13.2
This is the first release that contains the fix.
pip install --upgrade "python-engineio==4.13.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional checks in their application code to validate the size of incoming messages before processing them. For example, you can limit the size of incoming requests in your ASGI application or configure Aiohttp to reject large WebSocket messages.
Conclusion
In summary, CVE-2026-48809 poses a significant risk to applications using python-engineio due to its potential for denial of service attacks. It is crucial for developers to update to version 4.13.2 or later to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for python-engineio →
FAQ
CVE-2026-48809 is a vulnerability in the python-engineio library that allows for denial of service due to unchecked payload sizes in certain configurations.
If exploited, this vulnerability can lead to excessive memory usage, potentially causing your application to crash or become unresponsive.
Versions of python-engineio up to and including 4.13.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
