CVE-2026-48802: python-engineio Denial of Service via Unbound Thread Allocation
Summary
CVE-2026-48802: python-engineio has unbound thread allocation that can cause denial of service. Affects python-engineio versions < 4.13.2. Fixed in 4.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that provides a server-side implementation of the Engine.IO protocol, which is used for real-time communication between clients and servers. It is commonly utilized in web applications to facilitate bi-directional communication. The library supports both synchronous and asynchronous server implementations, allowing developers to choose the best fit for their application architecture. However, it is susceptible to a vulnerability that can lead to denial of service due to unbound thread allocation.
Vulnerability Detail
The vulnerability arises from the heartbeat mechanism in the python-engineio server, which creates a new thread for each new connection and when a client sends a PONG packet. This can lead to excessive thread creation, particularly in synchronous servers, potentially exhausting system resources and causing denial of service. Although asynchronous servers are less affected due to their use of lightweight tasks instead of threads, the issue still exists and has been addressed in the latest patch.
How To Fix
Latest published version: 4.14.0 as of 23 Oct 2026
pip install --upgrade "python-engineio==4.14.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.13.2
This is the first release that contains the fix.
pip install --upgrade "python-engineio==4.13.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent connections to your server or implement rate limiting to reduce the impact of this vulnerability until you can apply the patch.
Conclusion
The python-engineio library has a vulnerability (CVE-2026-48802) that can lead to denial of service due to unbound thread allocation. It is crucial to update to version 4.13.2 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for python-engineio →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions prior to 4.13.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to denial of service, causing your application to become unresponsive due to excessive thread creation.
While the vulnerability primarily affects synchronous servers, it has been addressed in asynchronous implementations as well.
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
