Description

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers. Asynchronous servers allocate background tasks instead of physical threads, which are lightweight and less likely to cause denial of service. However, the fix that was implemented was also applied to the asynchronous case. Version 4.13.2 addresses this issue as follows: The initial background thread (or async task( for heartbeat management is only launched if a client passes authentication in the `connect` handler; and the server now ensures that there is only one background heatbeat thread (or async task) per client at a given point in time. Out of sequence PONG packets are now discarded when an active heartbeat thread is already running.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T19:17:37.120Z",
  "pubdate": "2026-08-11T19:17:37.120Z",
  "executiveSummary": "An improper resource management vulnerability exists in python-engineio prior to version 4.13.2, specifically within the heartbeat mechanism of the server implementation.\nThe vulnerability allows an unauthenticated or newly connecting attacker to induce the creation of unnecessary background threads or asynchronous tasks.\nThis flaw primarily impacts synchronous servers by exhausting system threads, leading to a potential denial of service condition.\nAsynchronous servers allocate lightweight tasks, which are inherently less susceptible to direct thread exhaustion, though the original logic affected both execution models.\nAttackers can exploit this by manipulating connection handshakes and flooding the server with out-of-sequence PONG packets.\nSuccessful exploitation degrades server performance, consumes critical system resources, and can disrupt availability for legitimate clients attempting real-time communication.",
  "technicalDetails": "The vulnerability stems from flawed concurrency and state management within the python-engineio heartbeat mechanism, residing in the server connection and packet handling components for versions prior to 4.13.2.\nThe root cause involves the unchecked initialization of background heartbeat threads or tasks upon receiving a new connection and every time a client transmits a PONG packet, without verifying prior thread existence or authentication status.\nIn synchronous server deployments, this design forces the operating system to spawn physical system threads for each trigger, rapidly exhausting available thread pools and system memory.\nAlthough asynchronous servers utilize lightweight background tasks rather than physical threads, the lack of strict concurrency controls previously affected them as well.\nThe step-by-step attack flow involves an attacker initiating a connection to the python-engineio server and subsequently transmitting malicious or out-of-sequence PONG packets.\nBecause the server previously failed to ensure a single background heartbeat thread per client and launched threads before authentication, each incoming out-of-sequence PONG packet forced the instantiation of redundant background threads.\nNetwork exposure is inherent to any publicly accessible python-engineio server handling real-time client connections.\nAuthentication requirements were bypassed because initial threads were spawned prior to the client passing authentication within the connect handler.\nPrivilege requirements are negligible, as external unauthenticated clients can trigger the flaw remotely.\nThe post-exploitation impact is limited to resource exhaustion and denial of service via thread starvation, preventing legitimate users from establishing or maintaining real-time communication sessions."
}