EUVD-2026-56854
GHSA-m9gh-vj53-gvh9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable oversized messages with no privileges or interaction cause memory-exhaustion DoS (A:H), with no confidentiality or integrity impact; AC:L as flooding is straightforward.
Primary rating from Vendor (https://github.com/miguelgrinberg/python-engineio).
CVSS VectorVendor: https://github.com/miguelgrinberg/python-engineio
Lifecycle Timeline
2DescriptionCVE.org
Impact
There are two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are:
- POST requests, when using ASGI with the long polling transport
- WebSocket messages, when using Aiohttp with the WebSocket transport
Patches
Version 4.13.2 addresses this issue as follows:
- ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded.
- Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.
Articles & Coverage 1
AnalysisAI
Uncontrolled memory allocation in python-engineio (versions <= 4.13.1) lets remote attackers exhaust server memory by sending oversized messages that are loaded before any size check, causing denial of service (availability-only impact). The flaw triggers in two specific transport configurations - ASGI with long-polling POST requests, and Aiohttp with the WebSocket transport - and is fixed in 4.13.2. No public exploit identified at time of analysis, and the issue is not in CISA KEV; no EPSS score was provided.
Technical ContextAI
python-engineio is the Python implementation of the Engine.IO transport layer that underpins python-socketio, providing real-time bidirectional communication over long polling and WebSocket transports. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): in two server backends the incoming message body is read into memory before the configured maximum payload size is enforced. Specifically, ASGI servers buffered long-polling POST request bodies prior to authenticating the client or validating size, and Aiohttp-based WebSocket servers did not propagate a max-payload limit into Aiohttp's underlying WebSocket layer, so large frames reached the engineio layer unrestricted. The affected package is identified by CPE pkg:pip/python-engineio.
RemediationAI
Upgrade to python-engineio 4.13.2 or later, which is the vendor-released patch (pip install --upgrade 'python-engineio>=4.13.2'); the fix makes ASGI servers defer loading request bodies until the client is known, authenticated, and the payload is under the maximum allowed size, and makes Aiohttp servers enforce the max payload size in Aiohttp's WebSocket layer so oversized frames are discarded before reaching engineio. If immediate upgrade is not possible, place the service behind a reverse proxy or WAF that enforces a strict request/body size limit on the Engine.IO POST endpoint and caps WebSocket frame sizes (trade-off: must be tuned so legitimate large payloads are not dropped, and proxy-level WebSocket size enforcement is not universally supported), and restrict network access to the endpoint to trusted clients where feasible. Refer to advisory GHSA-m9gh-vj53-gvh9 (https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9) for authoritative guidance.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today