Detections
Analytics

SCA: security update for python-engineio (GHSA-m9gh-vj53-gvh9)

high Tenable Cloud Security Plugin ID 444085

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to
 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming
 messages is not checked before the messages are loaded into memory. An attacker can take advantage of
 these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST
 requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with
 the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of
 incoming requests into memory after the client is confirmed to be known and authenticated, and the payload
 size is below the maximum allowed size. Requests that do not comply with these requirements are discarded.
 Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that
 large messages are discarded by Aiohttp before they are delivered to python-engineio. (CVE-2026-48809)

Solution

Update the python-engineio library and its related packages to version 4.13.2 or later.

See Also

https://github.com/advisories/GHSA-m9gh-vj53-gvh9

Plugin Details

Severity: High

ID: 444085

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/27/2026

Updated: 8/12/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.78

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-48809

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/26/2026

Reference Information

CVE: CVE-2026-48809

cwe: CWE-770