python-engineio@4.12.3
Engine.IO server and client for Python
latest version
4.13.4
latest non vulnerable version
first published
11 years ago
latest version published
9 days ago
licenses detected
- [0,)
Direct Vulnerabilities
Known vulnerabilities in the python-engineio package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
python-engineio is a Python implementation of the Engine.IO realtime client and server. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of incoming messages when using ASGI with the long polling transport for POST requests or Aiohttp with the WebSocket transport. An attacker can exhaust system memory by sending large payloads that are not properly checked for size before being loaded into memory. This is only exploitable if the server is configured to use ASGI with long polling or Aiohttp with WebSocket transport. How to fix Allocation of Resources Without Limits or Throttling? Upgrade | [,4.13.2) |
python-engineio is a Python implementation of the Engine.IO realtime client and server. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the heartbeat mechanism. An attacker can exhaust system resources by repeatedly triggering the creation of unnecessary background threads through crafted connection and PONG packet sequences. How to fix Allocation of Resources Without Limits or Throttling? Upgrade | [,4.13.2) |