CVE catalog

CVE-2026-48804

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their bi

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-socketiosid5.17.0-1fixed
Debianpython-socketioforky5.17.0-1fixed
Debianpython-socketiotrixie5.12.1-1vulnerable
Debianpython-socketiobookworm5.7.2-2vulnerable
PyPIpython-socketioNot reported5.16.2fixed
Susepython-python-socketiolinux enterprise module for python 3 15 sp75.7.2-150600.3.6.1fixed
Susepython-python-socketiolinux enterprise server 15 sp6-ltss5.7.2-150600.3.6.1fixed
Susepython-python-socketiolinux enterprise server for sap applications 15 sp65.7.2-150600.3.6.1fixed
Opensusepython-python-socketiotumbleweed5.16.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-socketiosourcesid5.17.0-1not yet assignedNot reported[1144515]
Debianpython-socketiosourceforky5.17.0-1not yet assignedNot reported[1144515]
Debianpython-socketiosourcetrixie(unfixed)not yet assignedNot reported[1144515]
Debianpython-socketiosourcebookworm(unfixed)not yet assignedNot reported[1144515]
PyPIpython-socketioPyPINot reported5.16.2Not reportedNot reportedNot reported
Susepython-python-socketiorpmlinux enterprise module for python 3 15 sp75.7.2-150600.3.6.1Not reportedSUSE-SU-2026:3086-1Not reported
Susepython-python-socketiorpmlinux enterprise server 15 sp6-ltss5.7.2-150600.3.6.1Not reportedSUSE-SU-2026:3086-1Not reported
Susepython-python-socketiorpmlinux enterprise server for sap applications 15 sp65.7.2-150600.3.6.1Not reportedSUSE-SU-2026:3086-1Not reported
Opensusepython-python-socketiorpmtumbleweed5.16.3-1.1Not reportedOPENSUSE-SU-2026:11171-1Not reported

[Debian bug #1144515]

Notes

[trixie] python-socketio: Minor issue [bookworm] python-socketio: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-engineio]Affected

    Source package: [python-engineio]

    Details (2)

    • 4.3.4-2 · all · bookworm

      Affected

      nvd · python-engineio · debian · bookworm

    • 4.3.4-2 · all · bookworm

      Affected

      nvd · python-engineio · debian · bookworm

  • [python3-socketio]Affected

    Source package: [python-socketio]

    Details (2)

    • 5.7.2-2 · all · bookworm

      Affected

      nvd · python-socketio · debian · bookworm; nvd · python-socketio · debian · 12

    • 5.7.2-2 · all · bookworm

      Affected

      nvd · python-socketio · debian · bookworm; nvd · python-socketio · debian · 12

[Debian 13 (Trixie)]

  • [python3-socketio]Affected

    Source package: [python-socketio]

    Details (2)

    • 5.12.1-1 · all · trixie

      Affected

      nvd · python-socketio · debian · 13

    • 5.12.1-1 · all · trixie

      Affected

      nvd · python-socketio · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]