GHSA-CGWC-PV48-FHJ5 python-engineio has unbound thread allocation that can cause denial of service

🗓️ 26 Jun 2026 20:51:37Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Python-engineio can spawn extra heartbeat threads, denial of service; fix limits to one heartbeat per client.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2026-48802	27 May 202600:00	–	cve
Github Security Blog	python-engineio has unbound thread allocation that can cause denial of service	26 Jun 202620:51	–	github
Tenable Nessus	openSUSE 16 Security Update : python-python-engineio (openSUSE-SU-2026:21182-1)	2 Jul 202600:00	–	nessus
OSV	OPENSUSE-SU-2026:21182-1 Security update for python-python-engineio	30 Jun 202611:31	–	osv
OSV	ROOT-APP-PYPI-CVE-2026-48802 CVE-2026-48802 in rootio-python-engineio - Patched by Root	7 Jul 202603:26	–	osv
Positive Technologies	PT-2026-43621	27 May 202600:00	–	ptsecurity
Snyk	Allocation of Resources Without Limits or Throttling	26 Jun 202620:51	–	snyk
SUSE CVE	SUSE CVE-2026-48802	30 Jun 202601:44	–	susecve
vulnersOsv	appyter (>=0.16.0 <=0.20.2), aprsd (>=3.4.2 <=3.4.4) +27 more potentially affected by CVE-2026-48802 via python-engineio (>=4.0.0 <=4.13.1)	26 Jun 202620:51	–	vulnersosv
vulnersOsv	abdelrahman-obfuscate (>=1.0.0 <=1.0.1), abdo (=2.0.0) +181 more potentially affected by CVE-2026-48802 via python-engineio (>=3.10.0 <=4.13.1)	26 Jun 202620:51	–	vulnersosv