CVE-2026-48802: Python Engine.IO DoS Vulnerability

CVE-2026-48802 Overview

CVE-2026-48802 is a denial-of-service vulnerability in python-engineio, a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 allow an unauthenticated remote attacker to trigger the creation of unnecessary background threads by abusing the heartbeat mechanism. Each new connection and each client PONG packet spawns a thread, letting an attacker exhaust server resources. The issue primarily affects synchronous servers, where physical threads are allocated. Asynchronous servers are less exposed because they schedule lightweight background tasks, but the maintainer applied the fix to both paths. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An unauthenticated remote attacker can exhaust server thread resources by sending crafted connection and PONG packets, resulting in denial of service.

Affected Products

python-engineio versions prior to 4.13.2
Synchronous Engine.IO server deployments (primary impact)
Asynchronous Engine.IO server deployments (secondary impact)

Discovery Timeline

2026-08-11 - CVE-2026-48802 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48802

Vulnerability Analysis

The vulnerability resides in the Engine.IO heartbeat management logic. The server launches a background thread when a new connection is received and launches another thread each time the client sends a PONG packet. Neither event is gated by authentication or by a check for an existing heartbeat thread. An attacker can therefore establish connections and flood the server with out-of-sequence PONG packets to spawn arbitrary numbers of threads.

On synchronous deployments, each thread consumes an OS-level resource with a non-trivial stack allocation. The impact scales linearly with attacker input and quickly leads to process instability or host-level resource exhaustion. Asynchronous deployments allocate coroutine tasks instead of OS threads, so the practical impact is lower, but the same coding pattern applies and the maintainer patched both code paths.

Root Cause

The root cause is missing throttling and missing authentication gating around thread creation in the heartbeat handler. The server did not enforce a one-heartbeat-thread-per-client invariant, and it did not discard duplicate or out-of-sequence PONG packets while an active heartbeat thread was running. This maps directly to [CWE-770] Allocation of Resources Without Limits or Throttling.

Attack Vector

Exploitation is network-based, requires no privileges, and requires no user interaction. An attacker opens Engine.IO connections to a vulnerable server and repeatedly sends PONG packets on each session. Each packet causes the server to spawn a new heartbeat thread. Sustained traffic drives thread counts and memory usage until the server can no longer accept legitimate connections. Refer to the GitHub Security Advisory GHSA-cgwc-pv48-fhj5 for maintainer analysis.

Detection Methods for CVE-2026-48802

Indicators of Compromise

Rapid growth in worker thread count on Python processes running Engine.IO or Socket.IO servers.
Elevated memory consumption on the server process without a corresponding increase in legitimate client sessions.
Application logs showing repeated PONG packets from the same client identifier within short intervals.
Connections that authenticate and then generate abnormally high heartbeat traffic.

Detection Strategies

Monitor Python process thread counts and alert when values exceed a baseline for the deployment.
Instrument the Engine.IO server with metrics that count heartbeat threads per client session.
Correlate abnormal thread growth with inbound connection rates at the reverse proxy or load balancer.

Monitoring Recommendations

Track python-engineio package versions across the environment and flag any host running a version below 4.13.2.
Log and alert on connection storms from single source IP addresses hitting Engine.IO endpoints.
Capture process-level resource metrics (thread count, RSS, file descriptors) and forward them to a central telemetry pipeline.

How to Mitigate CVE-2026-48802

Immediate Actions Required

Upgrade python-engineio to version 4.13.2 or later on all affected servers.
Inventory dependent packages such as python-socketio and rebuild any pinned lockfiles that hold back the fix.
Restart affected services after upgrade so the patched heartbeat logic is loaded.
Rate-limit inbound connections to Engine.IO endpoints at the reverse proxy while patching is in progress.

Patch Information

Version 4.13.2 resolves the vulnerability with two changes. First, the initial heartbeat background thread (or async task) is created only after the client passes authentication inside the connect handler. Second, the server enforces a single active heartbeat thread per client and discards out-of-sequence PONG packets while that thread is running. See the GitHub Advisory Database entry PYSEC-2026-3032 for release metadata.

Workarounds

Enforce authentication inside the connect handler and reject anonymous sessions to reduce attacker access to the heartbeat path.
Place Engine.IO endpoints behind a reverse proxy that enforces per-IP connection limits and request-rate throttling.
Deploy asynchronous server implementations where practical, since they allocate lightweight tasks rather than OS threads.

bash

# Configuration example
pip install --upgrade 'python-engineio>=4.13.2'
pip show python-engineio | grep -i version