Description

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T20:17:42.580Z",
  "pubdate": "2026-08-11T20:17:42.580Z",
  "executiveSummary": "An unauthenticated memory exhaustion vulnerability exists in the python-socketio server implementation prior to version 5.16.4.\nThe flaw allows remote attackers to cause denial of service by consuming server memory resources.\nThe vulnerability affects python-socketio server instances handling binary EVENT and ACK messages.\nRisk implications include resource depletion, service degradation, and potential application crashes due to uncontrolled memory allocation.\nAn attacker must be capable of establishing network connections and submitting malformed binary messages to the Socket.IO server.\nPrior to the fix, exploitation did not require authentication or prior privileges, as binary packets were accepted from any connecting client.",
  "technicalDetails": "The root cause of the vulnerability lies in the state management of incoming binary packets within the python-socketio server.\nThe server allocates and holds binary EVENT and ACK messages in memory while awaiting the transmission of their corresponding binary attachments.\nThe vulnerable component is the binary message reassembly and buffering logic within the python-socketio server.\nAffected versions include all python-socketio server versions prior to 5.16.4.\nExploitation occurs when an attacker initiates a connection to the server and submits a binary message containing binary attachment placeholders.\nThe attacker intentionally omits sending one or more of the expected binary attachments, leaving the message and any received partial attachments in an indefinite pending state.\nBecause the server previously lacked timeout mechanisms or cleanup routines for disconnected clients with pending buffers, these incomplete messages remain resident in memory indefinitely.\nRepeated execution of this attack flow leads to unbounded memory consumption, ultimately resulting in resource exhaustion.\nNetwork exposure is inherent to any running Socket.IO server accepting client connections over the network.\nVersion 5.16.4 remediates this issue by enforcing authentication requirements for binary packet submission and introducing a cleanup mechanism that deletes pending partial binary messages when a client disconnects."
}