The python-engineio server has a denial of service vulnerability (CVE-2026-48809) in versions before 4.13.2 where the maximum payload size is not always enforced before loading incoming messages into memory. This affects two configurations: POST requests using ASGI with long polling transport, and WebSocket messages using Aiohttp with WebSocket transport. An attacker can exploit this to cause unnecessary memory consumption, potentially leading to service disruption. The issue is addressed in version 4.13.2 by enforcing client authentication and payload size checks before loading request bodies in ASGI, and by configuring maximum payload size in Aiohttp's WebSocket layer to discard large messages early.

This vulnerability allows unauthenticated remote attackers to cause a denial of service by triggering excessive memory allocation on the python-engineio server. The impact is limited to service availability (denial of service) with no confidentiality or integrity loss reported.

Upgrade python-engineio to version 4.13.2 or later, where the vulnerability is fixed by enforcing maximum payload size checks and client authentication before loading request bodies. No additional mitigation is required once the patch is applied.