Hi,
The following vulnerability was published for python-engineio.
CVE-2026-48802[0]:
| python-engineio is a Python implementation of the Engine.IO realtime
| client and server. Prior to version 4.13.2, an attacker can cause
| the creation of unnecessary background threads in the python-
| engineio server by exploiting the heartbeat mechanism, which
| launches a thread when a new connection is received, and when the
| client sends a PONG packet. This issue primarily affects synchronous
| servers. Asynchronous servers allocate background tasks instead of
| physical threads, which are lightweight and less likely to cause
| denial of service. However, the fix that was implemented was also
| applied to the asynchronous case. Version 4.13.2 addresses this
| issue as follows: The initial background thread (or async task( for
| heartbeat management is only launched if a client passes
| authentication in the `connect` handler; and the server now ensures
| that there is only one background heatbeat thread (or async task)
| per client at a given point in time. Out of sequence PONG packets
| are now discarded when an active heartbeat thread is already
| running.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48802
https://www.cve.org/CVERecord?id=CVE-2026-48802
[1] https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-cgwc-pv48-fhj5
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore