CVE-2026-48809
Description
A flaw was found in python-engineio. In specific configurations using ASGI with long polling or Aiohttp with WebSocket transport, the server does not properly validate the size of incoming messages before loading them into memory. A remote attacker can exploit this by sending oversized messages, leading to excessive memory allocation and potentially a Denial of Service (DoS) condition for the server.
Statement
Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can trigger memory exhaustion leading to a complete denial of service without requiring user interaction or elevated privileges. The underlying risk depends on specific server deployments, namely those running ASGI with long polling or Aiohttp with WebSocket transports. Red Hat enterprise products are not affected by this flaw because the vulnerable package configurations are not deployed in supported offerings.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
