Ack. thanks,
Em 16/08/2026 10:00, Salvatore Bonaccorso escreveu:
Source: python-engineio Version: 4.13.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Hi, The following vulnerability was published for python-engineio. CVE-2026-48802[0]: | python-engineio is a Python implementation of the Engine.IO realtime | client and server. Prior to version 4.13.2, an attacker can cause | the creation of unnecessary background threads in the python- | engineio server by exploiting the heartbeat mechanism, which | launches a thread when a new connection is received, and when the | client sends a PONG packet. This issue primarily affects synchronous | servers. Asynchronous servers allocate background tasks instead of | physical threads, which are lightweight and less likely to cause | denial of service. However, the fix that was implemented was also | applied to the asynchronous case. Version 4.13.2 addresses this | issue as follows: The initial background thread (or async task( for | heartbeat management is only launched if a client passes | authentication in the `connect` handler; and the server now ensures | that there is only one background heatbeat thread (or async task) | per client at a given point in time. Out of sequence PONG packets | are now discarded when an active heartbeat thread is already | running. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-48802 https://www.cve.org/CVERecord?id=CVE-2026-48802 [1] https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-cgwc-pv48-fhj5 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
-- Paulo Henrique de Lima Santana (phls) Belo Horizonte - Brasil Debian Developer Site: http://phls.com.br GPG ID: 0443C450
OpenPGP_signature.asc
Description: OpenPGP digital signature
