python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions before 4.13.2 have two configurations where incoming message sizes are not checked before loading into memory: POST requests under ASGI with long polling transport, and WebSocket messages under Aiohttp with WebSocket transport. This allows an attacker to cause excessive memory allocation, resulting in denial of service. The fix in 4.13.2 ensures ASGI servers only load request bodies after client authentication and size verification, and Aiohttp servers enforce maximum payload size at the WebSocket layer to discard large messages before delivery to python-engineio.

An attacker can exploit this vulnerability to cause a denial of service by sending large payloads that consume excessive memory on the python-engineio server. This impacts availability but does not affect confidentiality or integrity. No known exploits in the wild have been reported.

A patch is available in python-engineio version 4.13.2 that addresses this issue. Users should upgrade to version 4.13.2 or later. The fix enforces maximum payload size checks and discards requests that exceed limits or come from unauthenticated clients. No additional mitigation steps are required beyond applying the official fix.