debian/python-engineio vulnerabilities

Latest debian/python-engineio CVEs

Newest publication first

1. CVE-2026-48802 python-engineio has unbound thread allocation that can cause denial of service

   Published 2026-08-11

   High·CVSS 7.5 EPSS 0.58%

   python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when...

2. CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

   Published 2026-08-11

   High·CVSS 7.5 EPSS 0.49%

   python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An att...

3. CVE-2019-13611 python-engineio vulnerable to Cross-Site Request Forgery (CSRF)

   High·CVSS 8.7

   WebSocket cross-origin vulnerability Impact This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies. Patches python-engineio version 3.9.0 patches this vulnerability by adding server-side Or...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.