CVE-2026-48802

CVE-2026-48802 in python-engineio exposes an unbounded resource exhaustion vulnerability in the heartbeat thread lifecycle. When a client connects without authenticating, the library spawns heartbeat threads without any deduplication logic — meaning an attacker can flood a server with connection requests, each triggering a new heartbeat thread that never gets cleaned up. The resource exhaustion is straightforward: unbounded thread spawning on unauthenticated connections with no cleanup mechanism. The vulnerability manifests differently between sync and async server modes, but not because async provides an intentional security boundary. Async mode consumes lightweight tasks rather than OS threads, which has different resource characteristics — but both modes were vulnerable to the same underlying issue. The patch addresses this by coupling authentication state to heartbeat thread ownership: only authenticated clients trigger heartbeat threads, and the fix adds deduplication to prevent duplicate threads for the same session. What makes this值得关注 is the systemic pattern. The same mutation — unbounded resource spawning on unauthenticated connection events without deduplication — appeared in Socket.IO's 2019 heartbeat flooding CVEs (CVE-2019-14849, CVE-2019-14850). The institutional knowledge existed in the vulnerability database, but wasn't incorporated into python-engineio's threat model during development. That's not just a shared mental model gap; it's a retrieval failure where documented precedents didn't inform code review or dependency auditing. The sync mode being the less-maintained execution path isn't coincidental either. Documentation framed async as the "production" choice while treating sync as the simpler, development-oriented option — directing security-conscious users toward one path while leaving the other as the neglected sediment where assumptions calcified without scrutiny. The fix introduces a breaking change: applications relying on unauthenticated heartbeat behavior will need to add authentication integration. The dangerous alternative is developers workarounding the fix by disabling auth checks or stripping the library's auth integration entirely, which would degrade the security posture of deployments that can't upgrade cleanly. This creates an exposure window that doesn't close when the patch drops — it compounds as vulnerable versions remain deployable while organizations with slow patch cycles adapt insecurely.

Reviewed through automated stages and approved by a human before publication.