Denial of Service Vulnerability in python-engineio: Background Thread Exploitation
Summary
DEBIAN-CVE-2026-48802: python-engineio is a Python implementation of the Engine.IO realtime client and server. Affects python-engineio versions 4.0.0-1 – 4.9.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that implements the Engine.IO protocol, enabling real-time communication between clients and servers. It is widely used for building web applications that require instant data exchange. The library supports both synchronous and asynchronous server architectures, allowing developers to choose the best fit for their applications. However, prior to version 4.13.2, python-engineio had a vulnerability that could lead to the creation of unnecessary background threads, potentially resulting in a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability arises from the heartbeat mechanism in the python-engineio server, which creates a new thread for each new connection and when a client sends a PONG packet. This behavior can be exploited by an attacker to generate excessive background threads, particularly in synchronous server setups, leading to resource exhaustion and service unavailability. The issue has been addressed in version 4.13.2, which ensures that background threads are only created after client authentication and limits the number of threads per client.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent connections to your server or implement rate limiting to mitigate the risk of thread exhaustion until the package can be updated.
Conclusion
The python-engineio library has a vulnerability that can lead to denial of service through the exploitation of its heartbeat mechanism. Updating to version 4.13.2 or later is essential to mitigate this risk. Additionally, users can implement temporary workarounds while awaiting updates.
See every vulnerability recorded for python-engineio →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions prior to 4.13.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service (DoS) by exhausting server resources through excessive background thread creation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
