CVE-2026-48804

Name of the Vulnerable Software and Affected Versions python-socketio versions prior to 5.16.2

Description The server stores binary EVENT and ACK messages in memory while awaiting their binary attachments. An attacker can trigger a memory exhaustion issue by submitting a binary message and intentionally omitting one or more attachments, causing the partial message and its received attachments to persist in memory.

Recommendations Update to version 5.16.2 or later. As a temporary mitigation, restrict the use of binary packets to authenticated clients only and ensure partial binary messages are deleted upon client disconnection.