CVE-2026-48804: Python-SocketIO Memory DoS Vulnerability

CVE-2026-48804 Overview

CVE-2026-48804 is a resource exhaustion vulnerability in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary EVENT and ACK messages in memory while awaiting their binary attachments before processing. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit one or more attachments. The partial message and any received attachments remain in memory indefinitely, allowing unauthenticated clients to exhaust server memory. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Unauthenticated remote attackers can trigger unbounded memory consumption on python-socketio servers, leading to denial of service.

Affected Products

python-socketio versions prior to 5.16.4
Applications embedding the affected python-socketio server component
Both synchronous (server.py) and asynchronous (async_server.py) server implementations

Discovery Timeline

2026-08-11 - CVE-2026-48804 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48804

Vulnerability Analysis

The Socket.IO protocol permits binary payloads to be transmitted as separate frames following an initial EVENT or ACK header packet. The server buffers the header packet in the _binary_packet dictionary keyed by the Engine.IO session identifier (eio_sid) and waits for the expected number of binary attachments before dispatching the event. No timeout, retention limit, or authentication check governs how long these partial packets persist.

An attacker can repeatedly connect and send header packets declaring one or more binary attachments without ever transmitting them. Each connection consumes memory for the buffered header and any partial attachments received. Because entries are never garbage-collected on disconnect, the memory footprint grows without bound and eventually exhausts the process.

Root Cause

The root cause is missing lifecycle management of the _binary_packet buffer. When a client disconnects with an incomplete binary packet outstanding, the server does not remove the entry from the buffer. Combined with the absence of authentication requirements for binary message acceptance, any network-reachable client can allocate server memory indefinitely.

Attack Vector

The attack is remotely exploitable over the network with no privileges or user interaction. An attacker opens a Socket.IO connection, sends a binary EVENT or ACK header declaring attachments, then disconnects without sending them. Repeating this loop from one or more sources drives the server into a memory-exhaustion condition and denial of service.

python

# Security patch in src/socketio/async_server.py
# Delete incomplete binary packet when client disconnects
        if not self.manager.is_connected(sid, namespace):  # pragma: no cover
            return
        self.manager.pre_disconnect(sid, namespace=namespace)
        if eio_sid in self._binary_packet:
            del self._binary_packet[eio_sid]
        await self._trigger_event('disconnect', namespace, sid,
                                  reason or self.reason.CLIENT_DISCONNECT)
        await self.manager.disconnect(sid, namespace, ignore_queue=True)
# Source: https://github.com/miguelgrinberg/python-socketio/commit/4bec3ef87bcfd6ab5b94cd3ac09d873283a6960e

The patch adds an explicit check for a pending _binary_packet entry and deletes it during disconnect handling in both the synchronous and asynchronous server implementations.

Detection Methods for CVE-2026-48804

Indicators of Compromise

Sustained growth of the python-socketio server process resident memory without a corresponding rise in active sessions.
High volume of short-lived Socket.IO connections from a single source that establish, send a binary header packet, and disconnect.
Elevated counts of binary EVENT (packet type 5) or binary ACK (packet type 6) frames without matching attachment payloads.

Detection Strategies

Instrument the application to expose the size of the internal _binary_packet dictionary as a metric and alert on abnormal growth.
Inspect Engine.IO transport logs for repeated open and close events tied to session IDs that never complete a binary transfer.
Correlate web application firewall or reverse proxy logs to identify clients issuing malformed Socket.IO binary sequences at high rate.

Monitoring Recommendations

Monitor process memory and file descriptor counts of Socket.IO server workers and trigger alerts on sustained upward trends.
Track per-source-IP connection rates and disconnect ratios to the Socket.IO endpoint.
Enable structured application logging for disconnect events and buffered-packet cleanup to validate patched behavior.

How to Mitigate CVE-2026-48804

Immediate Actions Required

Upgrade python-socketio to version 5.16.4 or later on all server deployments.
Audit dependent applications and frameworks such as python-engineio-based stacks that bundle python-socketio and update transitively.
Restrict Socket.IO endpoints to authenticated clients where possible, since version 5.16.4 only accepts binary packets from authenticated clients.

Patch Information

The fix is delivered in python-socketio 5.16.4. Two changes address the issue: binary packets are only accepted from authenticated clients, and the server deletes any pending _binary_packet entry when a client disconnects. See the GitHub Security Advisory GHSA-5w7q-77mv-v69f and the upstream commit for details.

Workarounds

Place the Socket.IO endpoint behind an authenticating reverse proxy so unauthenticated clients cannot submit binary packets.
Apply rate limiting and per-IP connection limits at the load balancer to reduce the amplification factor of the attack.
Enforce strict resource limits (for example, container memory ceilings and process restart policies) so a single worker cannot exhaust host memory.

bash

# Configuration example: pin the patched version
pip install --upgrade 'python-socketio>=5.16.4'

# Verify installed version
python -c "import socketio; print(socketio.__version__)"