CVE-2026-48802: 
Python vulnerability analysis and mitigation

CVE-2026-48802 is a denial-of-service vulnerability in python-engineio, a Python implementation of the Engine.IO realtime client and server, caused by unbound thread allocation in the heartbeat mechanism. An unauthenticated remote attacker can trigger the creation of excessive background threads by exploiting how the server handles new connections and PONG packets. All versions up to and including 4.13.1 are affected; version 4.13.2 contains the fix. The vulnerability was first published by the maintainer on May 23, 2026, and added to the GitHub Advisory Database on June 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the server's heartbeat mechanism spawns a new background thread both when a connection is received and each time a client sends a PONG packet, without enforcing any cap on the number of threads per client or requiring prior authentication. An attacker can repeatedly send PONG packets or initiate connections to continuously spawn threads, exhausting server resources. This issue primarily affects synchronous servers, where threads are OS-level resources; asynchronous servers use lightweight background tasks and are less susceptible, though the fix was applied to both modes. No public proof-of-concept exploit code has been identified, but the attack is straightforward to implement using standard Engine.IO client libraries (Github Advisory, GitHub Security Advisory).

Successful exploitation results in thread exhaustion on the affected server, leading to denial of service — the server becomes unresponsive or crashes due to resource depletion. There is no impact on confidentiality or data integrity; the vulnerability is purely an availability issue. Applications built on synchronous python-engineio servers (including those using python-socketio backed by this library) are most at risk, as OS-level thread exhaustion can affect the entire hosting process and any co-located services (Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-48802. The NVD SSVC assessment classifies exploitation as "none" and the attack as "automatable," meaning it can be scripted without manual interaction. The EPSS score is approximately 0.318%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory, GitHub Security Advisory).

1. Reconnaissance: Identify internet-facing services running python-engineio (synchronous mode) version ≤ 4.13.1, which may be exposed as WebSocket or HTTP long-polling endpoints (commonly on ports 80, 443, or custom ports).
2. Initiate connections: Open multiple Engine.IO connections to the target server. Each new connection triggers the server to spawn a background heartbeat thread without requiring authentication.
3. Send unsolicited PONG packets: After connecting, repeatedly send PONG packets out of sequence or at high frequency. Each PONG causes the server to spawn an additional heartbeat thread per the vulnerable logic.
4. Exhaust server threads: By maintaining many concurrent connections and sending repeated PONG packets across all of them, the attacker causes the server's thread pool or OS thread limit to be exhausted.
5. Achieve denial of service: Once thread resources are depleted, the server becomes unable to handle new or existing connections, resulting in service unavailability (Github Advisory, GitHub Security Advisory).

• Network: Unusually high volume of Engine.IO connection requests or WebSocket upgrade requests from one or more source IPs; large numbers of concurrent connections to the Engine.IO endpoint.
• Process: Rapidly increasing thread count in the python-engineio server process (observable via ps, top, or /proc/<pid>/status); process memory and CPU usage climbing without a corresponding increase in legitimate client activity.
• Logs: Server logs showing repeated PONG packets received from the same client session without corresponding PING packets; log entries indicating thread creation events at abnormal rates; connection events from the same IP without subsequent authenticated activity.
• System: OS-level errors related to thread or resource limits (e.g., OSError: [Errno 11] Resource temporarily unavailable or can't start new thread in Python tracebacks).

Upgrade python-engineio to version 4.13.2 or later, which resolves the issue by: (1) only launching the initial heartbeat thread/task if the client passes authentication in the connect handler; (2) enforcing a single heartbeat thread per client at any given time; and (3) discarding out-of-sequence PONG packets when an active heartbeat thread is already running. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. Operators using SUSE Linux can also apply the vendor-provided package update (SUSE-SU-2026:3085-1) (Github Advisory, SUSE Advisory).

The vulnerability was reported by security researcher mauriceng98 and addressed promptly by maintainer Miguel Grinberg in version 4.13.2. SUSE issued a security update (SUSE-SU-2026:3085-1) incorporating the fix for their distributions, and openSUSE published a corresponding advisory. Tenable added detection plugins (Nessus IDs 327736 and 335307) for the vulnerability. No significant broader media coverage or notable social media discussion beyond standard vulnerability tracking has been observed (SUSE Advisory, Github Advisory).