PT-2026-43621 · Pypi · Python-Engineio

CVE-2026-48802 · Published 2026-05-27 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions python-engineio versions prior to 4.13.2

Description An attacker can trigger the creation of unnecessary background threads in the server by exploiting the heartbeat mechanism. This occurs when a new connection is received or when a client sends a PONG packet. This issue primarily impacts synchronous servers, as they allocate physical threads, whereas asynchronous servers use lightweight background tasks.

Recommendations Update to version 4.13.2.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-48802

GHSA-CGWC-PV48-FHJ5

OPENSUSE-SU-2026:21182-1

PYSEC-2026-3032

SUSE-SU-2026:3085-1

Affected Products

Python-Engineio

References · 16

• https://osv.dev/vulnerability/openSUSE-SU-2026:21182-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-48802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48802 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:3085-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3032 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgwc-pv48-fhj5 · Vendor Advisory
• https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-cgwc-pv48-fhj5 · Note
• https://github.com/miguelgrinberg/python-engineio · Note
• https://bugzilla.suse.com/1269545 · Note
• https://github.com/advisories/GHSA-cgwc-pv48-fhj5 · Note
• https://suse.com/security/cve/CVE-2026-48802 · Note
• https://pypi.org/project/python-engineio · Note
• https://reddit.com/r/Network/comments/1toxhip/threat_intel_may_26_2026_vulnerability · Reddit Post
• https://suse.com/support/update/announcement/2026/suse-su-20263085-1 · Note
• https://suse.com/security/cve/CVE-2026-48809 · Note