Hi,
The following vulnerability was published for python-engineio.
CVE-2026-48809[0]:
| python-engineio is a Python implementation of the Engine.IO realtime
| client and server. Versions prior to 4.13.2 have two specific
| configurations of the python-engineio server in which the size of
| incoming messages is not checked before the messages are loaded into
| memory. An attacker can take advantage of these to cause unnecessary
| memory allocations in the python-engineio server. The two cases are
| POST requests, when using ASGI with the long polling transport and
| WebSocket messages, when using Aiohttp with the WebSocket transport.
| Version 4.13.2 addresses this issue. ASGI severs now only load the
| body of incoming requests into memory after the client is confirmed
| to be known and authenticated, and the payload size is below the
| maximum allowed size. Requests that do not comply with these
| requirements are discarded. Aiohttp servers configure the maximum
| payload size in the underlying WebSocket layer from Aiohttp, so that
| large messages are discarded by Aiohttp before they are delivered to
| python-engineio.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48809
https://www.cve.org/CVERecord?id=CVE-2026-48809
[1] https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore