Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. python-socketio
  4. ›
  5. CVE-2026-48804

CVE-2026-48804: python-socketio: Binary attachment accumulation can cause denial of service

June 26, 2026

The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time.

References

  • github.com/advisories/GHSA-5w7q-77mv-v69f
  • github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-5w7q-77mv-v69f
  • nvd.nist.gov/vuln/detail/CVE-2026-48804

Code Behaviors & Features

Detect and mitigate CVE-2026-48804 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 5.16.2

Fixed versions

  • 5.16.2

Solution

Upgrade to version 5.16.2 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-770: Allocation of Resources Without Limits or Throttling

Source file

pypi/python-socketio/CVE-2026-48804.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 27 Jun 2026 00:17:08 +0000.