CVE-2026-48809: python-engineio DoS Vulnerability

CVE-2026-48809 Overview

CVE-2026-48809 is an uncontrolled resource consumption vulnerability [CWE-770] in python-engineio, a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 fail to enforce size limits on incoming messages before loading them into memory. Attackers can send oversized payloads to cause excessive memory allocations on the server.

Two server configurations are affected: POST requests when using Asynchronous Server Gateway Interface (ASGI) with the long polling transport, and WebSocket messages when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses the issue by validating request size and authentication state before loading payloads.

Critical Impact
Remote unauthenticated attackers can trigger memory exhaustion in vulnerable python-engineio deployments, causing denial of service against realtime application servers.

Affected Products

python-engineio versions prior to 4.13.2 running under ASGI with long polling transport
python-engineio versions prior to 4.13.2 running under Aiohttp with WebSocket transport
Applications built on python-socketio that depend on affected python-engineio releases

Discovery Timeline

2026-08-11 - CVE-2026-48809 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48809

Vulnerability Analysis

The flaw is a resource exhaustion issue rooted in missing input size validation on the server transport layer. When python-engineio runs under ASGI with long polling, incoming POST request bodies are read into memory before the server evaluates whether the client is authenticated or whether the payload conforms to the configured maximum size. An attacker can submit large POST bodies repeatedly and force the server to allocate memory for data it will ultimately reject.

The second variant affects deployments using Aiohttp as the WebSocket transport. The server does not propagate the maximum message size configuration to the underlying Aiohttp WebSocket layer. Aiohttp therefore accepts arbitrarily large WebSocket frames and forwards them to python-engineio for processing, again causing unbounded memory growth.

Both issues fall under CWE-770: Allocation of Resources Without Limits or Throttling. Successful exploitation degrades service availability and can crash the host process once memory pressure exceeds system limits.

Root Cause

The root cause is a missing size and authentication check in the request ingress path. ASGI POST handlers loaded request bodies into memory prior to enforcing authentication or size policy. The Aiohttp WebSocket handler relied on default Aiohttp limits rather than passing the application-configured maximum, leaving the transport permissive by default.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction. An attacker sends either a POST request with an oversized body to the long polling endpoint on an ASGI deployment, or a WebSocket message exceeding intended size limits against an Aiohttp deployment. Repeated requests amplify memory pressure and can render the server unresponsive. See the GitHub Security Advisory GHSA-m9gh-vj53-gvh9 for maintainer details.

Detection Methods for CVE-2026-48809

Indicators of Compromise

Sustained high memory utilization or out-of-memory (OOM) terminations in processes hosting python-engineio
Unusual volumes of POST requests to Engine.IO long polling endpoints from a small set of source addresses
Abnormally large WebSocket frames delivered to Aiohttp-backed Engine.IO endpoints
Application logs showing dropped or truncated Engine.IO sessions coinciding with memory spikes

Detection Strategies

Inventory Python environments for python-engineio versions below 4.13.2 using pip list or software composition analysis tools
Instrument reverse proxies to log request body sizes for Engine.IO endpoints and alert on outliers
Correlate process memory metrics with request rate to identify allocation-driven exhaustion patterns
Review dependency manifests of downstream libraries such as python-socketio for transitive exposure

Monitoring Recommendations

Emit metrics for per-connection payload size at the WebSocket and long polling layers
Alert on repeated 413 Payload Too Large responses or connection resets from Engine.IO services
Track resident set size (RSS) growth of application workers hosting realtime services

How to Mitigate CVE-2026-48809

Immediate Actions Required

Upgrade python-engineio to version 4.13.2 or later in all affected environments
Restart application workers after upgrade to ensure the patched code path is loaded
Enforce authenticated access to Engine.IO endpoints where feasible to limit anonymous request volume
Place a reverse proxy in front of exposed Engine.IO servers to enforce request size limits

Patch Information

Version 4.13.2 of python-engineio resolves the issue. ASGI servers now load incoming request bodies only after confirming the client is known and authenticated and that the payload size falls below the configured maximum. Non-conforming requests are discarded. Aiohttp servers now propagate the maximum payload size to the underlying Aiohttp WebSocket layer, so oversized messages are discarded by Aiohttp before reaching python-engineio. Refer to the PyPA Advisory Database entry PYSEC-2026-3033 for the authoritative record.

Workarounds

Configure reverse proxies (nginx, HAProxy, Envoy) to cap request body size for Engine.IO paths
Restrict Aiohttp WebSocket max_msg_size explicitly at the application layer until the upgrade is deployed
Rate-limit unauthenticated POST traffic to long polling endpoints at the edge

bash

# Upgrade python-engineio to the patched release
pip install --upgrade 'python-engineio>=4.13.2'

# Verify installed version
python -c "import engineio; print(engineio.__version__)"