Allocation of Resources Without Limits or Throttling in Python Engine.IO - #VU132252
Published: May 25, 2026
Vulnerability identifier: #VU132252
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the heartbeat mechanism when handling new connections and PONG packets. A remote attacker can send connection attempts and crafted PONG packets to cause a denial of service.
This issue primarily affects synchronous servers, while asynchronous servers allocate background tasks instead of physical threads.
Affected software
Python Engine.IO
Remediation
Install security update from vendor's website.
Python Engine.IO - update to 4.13.2