Allocation of Resources Without Limits or Throttling in Python Engine.IO - CVE-2026-48802
Published: May 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU132252
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48802
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the heartbeat mechanism when handling new connections and PONG packets. A remote attacker can send connection attempts and crafted PONG packets to cause a denial of service.
This issue primarily affects synchronous servers, while asynchronous servers allocate background tasks instead of physical threads.
Affected software
Python Engine.IO
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
python311-python-engineio
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
python311-python-engineio
How to mitigate CVE-2026-48802
Install security update from vendor's website.
Python Engine.IO - update to 4.13.2
python311-python-engineio - update to 4.3.4-150600.3.3.1
python311-python-engineio - update to 4.3.4-150600.3.3.1