CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service
An attacker can cause denial of service in python-engineio synchronous servers by triggering unbound thread allocation via the heartbeat mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48802?
CVE-2026-48802 is a high-severity denial of service vulnerability in miguelgrinberg python-engineio, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers. Asynchronous servers allocate background tasks instead of physical threads, which are lightweight and less likely to cause denial of service. However, the fix that was implemented was also applied to the asynchronous case. Version 4.13.2 addresses this issue as follows: The initial background thread (or async task( for heartbeat management is only launched if a client passes authentication in the `connect` handler; and the server now ensures that there is only one background heatbeat thread (or async task) per client at a given point in time. Out of sequence PONG packets are now discarded when an active heartbeat thread is already running.
Weakness: CWE-770
Which versions are affected by CVE-2026-48802?
3 open source packages ship an affected version, including python-engineio.
| Package | Affected | Fixed in |
|---|---|---|
python-engineio PyPI | All versions | 4.13.2 |
python-engineio PyPI | All versions | 4.13.2 |
python-engineio PyPI | All versions | 4.13.2 |
How do I fix CVE-2026-48802?
Upgrade python-engineio to 4.13.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48802 being exploited?
There is no known exploitation of CVE-2026-48802 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-48802, GHSA-cgwc-pv48-fhj5, PYSEC-2026-3032, ROOT-APP-PYPI-CVE-2026-48802, UBUNTU-CVE-2026-48802.