CVE-2026-48804
Description
A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. This causes the incomplete messages to persist in memory, leading to excessive memory consumption and ultimately a Denial of Service (DoS) for the server.
Statement
A denial of service flaw exists in python-socketio's binary packet assembly mechanism. When handling incoming binary EVENT and ACK payloads, the server retains incomplete messages and partial attachments in memory while awaiting remaining attachments. An unauthenticated remote attacker can submit binary headers while deliberately withholding attachment streams, causing untracked memory accumulation until memory exhaustion occurs. When python-socketio processes unauthenticated websocket connections, malformed payload streams can degrade or crash the service, posing an Important impact to availability.
Mitigation
Require authentication for all client connections before accepting socket requests, or enforce connection timeouts at the reverse proxy layer to disconnect incomplete binary payload streams.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
