GHSA-5w7q-77mv-v69f

Source

https://github.com/advisories/GHSA-5w7q-77mv-v69f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5w7q-77mv-v69f/GHSA-5w7q-77mv-v69f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5w7q-77mv-v69f

Aliases

Published

2026-06-26T20:51:58Z

Modified

2026-07-13T16:43:50Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

python-socketio: Binary attachment accumulation can cause denial of service

Details

Impact

The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time.

Patches

Version 5.16.2 takes the following measures to address this issue:

Binary packets are only accepted from authenticated clients.
When a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T20:51:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

PyPI / python-socketio

Package

Name: python-socketio; View open source insights on deps.dev
Purl: pkg:pypi/python-socketio

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.16.2

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.4.0

0.4.1

0.4.2

0.5.0

0.5.1

0.5.2

0.6.0

0.6.1

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

0.9.1

0.9.2

1.*

1.0

1.1

1.2

1.3

1.4

1.4.1

1.4.2

1.4.3

1.4.4

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

2.*

2.0.0

2.1.0

2.1.1

2.1.2

3.*

3.0.0

3.0.1

3.1.0

3.1.1

3.1.2

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.1.0

4.2.0

4.2.1

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.6.0

4.6.1

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.1.0

5.2.0

5.2.1

5.3.0

5.4.0

5.4.1

5.5.0

5.5.1

5.5.2

5.6.0

5.7.0

5.7.1

5.7.2

5.8.0

5.9.0

5.10.0

5.11.0

5.11.1

5.11.2

5.11.3

5.11.4

5.12.0

5.12.1

5.13.0

5.14.0

5.14.1

5.14.2

5.14.3

5.15.0

5.15.1

5.16.0

5.16.1

Database specific

last_known_affected_version_range

"<= 5.16.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5w7q-77mv-v69f/GHSA-5w7q-77mv-v69f.json"