python-engineio EUVD-2026-56859

Exploitation targets the Engine.IO heartbeat mechanism: the attacker must be able to reach the server's Engine.IO endpoint over the network and send PONG packets, particularly out-of-sequence ones, to trigger repeated background worker creation. Impact is greatest on synchronous python-engineio servers (<= 4.13.1), where each allocation is a physical OS thread; asynchronous servers are significantly limited because they allocate lightweight tasks instead. A key limiting factor is authentication: applications that enforce authentication in the connect handler constrain who can reach the amplification path, and the 4.13.2 fix explicitly ties heartbeat-worker launch to passing that authentication - so default unauthenticated deployments are most exposed, while authenticated ones raise the bar.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated attack with availability-only impact and no confidentiality or integrity effect - consistent with a pure DoS. No EPSS score was supplied, the CVE is not in CISA KEV, and no SSVC decision data or POC was provided, so the only strong exploitation signal is the CVSS vector itself. Notably, the patch description states the fix only launches the initial heartbeat worker once a client passes authentication in the connect handler, which implies that deployments enforcing authentication in connect materially raise the bar - this partially conflicts with the PR:N rating, since a hardened app may require a valid authenticated session before the most damaging amplification path opens. The real-world severity is also moderated by deployment mode: synchronous servers face genuine thread-exhaustion risk, while async servers (the more common high-scale configuration) are largely insulated. Treat this as a real but bounded DoS priority - patch promptly on synchronous deployments, lower urgency on authenticated or async ones.

An attacker opens an Engine.IO connection to a synchronous python-engineio server and then repeatedly sends out-of-sequence PONG packets, each of which causes the server to spawn an additional background heartbeat thread. By scripting many connections and PONG floods, the attacker drives unbounded thread creation until the server exhausts memory or scheduling capacity and stops serving legitimate users. No public POC is identified, but the attack is low-complexity and requires only the ability to speak the Engine.IO protocol to a reachable endpoint.