Source: python-engineio Version: 4.13.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for python-engineio. CVE-2026-48809[0]: | python-engineio is a Python implementation of the Engine.IO realtime | client and server. Versions prior to 4.13.2 have two specific | configurations of the python-engineio server in which the size of | incoming messages is not checked before the messages are loaded into | memory. An attacker can take advantage of these to cause unnecessary | memory allocations in the python-engineio server. The two cases are | POST requests, when using ASGI with the long polling transport and | WebSocket messages, when using Aiohttp with the WebSocket transport. | Version 4.13.2 addresses this issue. ASGI severs now only load the | body of incoming requests into memory after the client is confirmed | to be known and authenticated, and the payload size is below the | maximum allowed size. Requests that do not comply with these | requirements are discarded. Aiohttp servers configure the maximum | payload size in the underlying WebSocket layer from Aiohttp, so that | large messages are discarded by Aiohttp before they are delivered to | python-engineio. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-48809 https://www.cve.org/CVERecord?id=CVE-2026-48809 [1] https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
