miguelgrinberg Vulnerabilities and Affected Products
Vulnerabilities associated with python-engineio.
Products
Clear product- python-engineio2 vulnerabilities
- python-socketio2 vulnerabilities
- Flask-HTTPAuth1 vulnerability
- microdot1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48802HIGH | python-engineio has unbound thread allocation that can cause denial of servicepython-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers. Asynchronous servers allocate background tasks instead of physical threads, which are lightweight a… CWE-770Aug 11, 2026 | CVSS7.5v3.1 | EPSS0.318% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-48809HIGH | python-engineio has possible denial of service due to maximum payload size sometimes not being enforcedpython-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using… CWE-770Aug 11, 2026 | CVSS7.5v3.1 | EPSS0.279% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |