CVE-2026-48809

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.

• CWE-770

• https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9
• https://github.com/pypa/advisory-database/tree/main/vulns/python-engineio/PYSEC-2026-3033.yaml

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48802python-engineio is a Python implementation of the Engine.IO …7.5
• CVE-2026-48804python-socketio is a Python implementation of the Socket.IO …7.5
• CVE-2026-48805Twig is a template language for PHP. Prior to 3.27.0, deprec…9.1
• CVE-2026-48806Twig is a template language for PHP. Prior to 3.27.0, ArrayE…9.1
• CVE-2026-48807Twig is a template language for PHP. Prior to 3.27.0, the sa…9.1
• CVE-2026-48808Twig is a template language for PHP. Prior to 3.27.0, the co…7.5
• CVE-2026-4881In affected versions of Octopus Server, permissions were not…6.5
• CVE-2026-48810FreeScout is a free help desk and shared inbox built with PH…4.3
• CVE-2026-48811FreeScout is a free help desk and shared inbox built with PH…4.3
• CVE-2026-48812FreeScout is a free help desk and shared inbox built with PH…7.5
• CVE-2026-48813Flawfinder is a a static analysis tool for finding vulnerabi…8.7
• CVE-2026-48814Network-AI is a TypeScript/Node.js multi-agent orchestrator.…9.1