Memory Retention Vulnerability in python-engineio: Risk of Denial of Service
Summary
DEBIAN-CVE-2026-48804: python-socketio is a Python implementation of the Socket.IO realtime client and server. Affects python-engineio versions 4.0.0-1 – 4.9.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that provides the engine for Socket.IO, enabling real-time communication between clients and servers. It is widely used in web applications to facilitate bi-directional communication. The library supports various transport protocols and is designed to handle both binary and text data efficiently. However, prior to version 5.16.4, it was vulnerable to a memory retention issue that could be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the way python-engineio handles binary EVENT and ACK messages. When a binary message is submitted, the server waits for its attachments to be received before processing it. An attacker can exploit this by sending a binary message and omitting some attachments, causing the message and the partial list of received attachments to remain in memory for an extended period. This can lead to excessive memory usage and potentially a denial of service, as the server may become overwhelmed by retained messages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement client authentication to restrict access to the binary message handling. Ensure that only authenticated clients can send binary messages to the server, thereby mitigating the risk of this vulnerability until the package is updated.
Conclusion
The vulnerability in python-engineio poses a significant risk due to its potential for denial of service through memory retention. It is crucial for users to update to version 5.16.4 or later to mitigate this risk. Implementing client authentication can serve as a temporary workaround while ensuring the application remains secure.
See every vulnerability recorded for python-engineio →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions prior to 5.16.4 are affected by this vulnerability.
Exploitation of this vulnerability can lead to excessive memory usage and denial of service, affecting the availability of the application.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
In version 5.16.4, measures were implemented to ensure that binary packets are only accepted from authenticated clients, and partial binary messages are deleted when a client disconnects.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
