python-engineio has possible denial of service due to maximum payload size sometimes not being enforced (CVE-2026-48809) | HOL Guard CVE

High · CVSS 7.5CVE-2026-48809GHSA-M9GH-VJ53-GVH9

python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

Answer in brief

CVE-2026-48809 records a High severity (CVSS 7.5) vulnerability in python-engineio has possible denial of service due to maximum payload size sometimes not being enforced. The current sources do not mark it as known exploited. The current feed maps miguelgrinberg/python-engineio (generic), python-engineio (pip). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 11, 2026Updated Aug 11, 2026Source checked Sep 17, 2026First seen by HOL Jun 26, 2026Material review Aug 11, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.5
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps miguelgrinberg/python-engineio (generic), python-engineio (pip). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
miguelgrinberg/python-engineiogeneric	< 4.13.2	Not reported
python-engineiopip	<=4.13.1	4.13.2

Recommended response

Check inventory. Check lockfiles and deployed manifests for miguelgrinberg/python-engineio, python-engineio.
Review the reported fix. Update python-engineio to 4.13.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 26, 2026

Sources and claim methodology

Upstream source description

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.

Quoted source text, attributed separately from HOL analysis.