The python-engineio library before version 4.13.2 has a flaw in its heartbeat mechanism that allows an attacker to trigger unnecessary background thread creation on the server side. Specifically, when a new connection is received and when a client sends a PONG packet, the server may launch multiple heartbeat threads if not properly controlled. This can exhaust server resources and cause denial of service, especially on synchronous servers that use physical threads. The fix in version 4.13.2 ensures that heartbeat threads or async tasks are only created after client authentication and enforces a single heartbeat thread per client, discarding out-of-sequence PONG packets if a heartbeat thread is active.

An attacker can cause denial of service by forcing the server to allocate excessive background threads, potentially exhausting system resources and disrupting service availability. This primarily impacts synchronous python-engineio servers. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported.

Upgrade python-engineio to version 4.13.2 or later, where the vulnerability is fixed. The fix restricts heartbeat thread creation to authenticated clients and limits one heartbeat thread per client. No other mitigation is required.