Your message dated Sat, 03 Oct 2026 14:34:01 +0000
with message-id <[email protected]>
and subject line Bug#1144515: fixed in python-socketio 5.17.0-1
has caused the Debian Bug report #1144515,
regarding python-engineio: CVE-2026-48804
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144515: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144515
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-engineio
Version: 4.13.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for python-engineio.
CVE-2026-48804[0]:
| python-socketio is a Python implementation of the Socket.IO realtime
| client and server. The python-socketio server stores binary `EVENT`
| and `ACK` messages in memory while it waits to receive their binary
| attachments. Once all the attachments are received, these messages
| are then processed. Prior to version 5.16.4, an attacker can submit
| a binary message and intentionally omit sending one or more of its
| attachments to cause the message along with the partial list of
| received attachments to stay in memory for a long time. Version
| 5.16.4 takes the following measures to address this issue: Binary
| packets are only accepted from authenticated clients and, when a
| client disconnects, the server checks if there is a partial binary
| message being held for the client and deletes it.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48804
https://www.cve.org/CVERecord?id=CVE-2026-48804
[1]
https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-5w7q-77mv-v69f
[2]
https://github.com/miguelgrinberg/python-socketio/commit/4bec3ef87bcfd6ab5b94cd3ac09d873283a6960e
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-socketio
Source-Version: 5.17.0-1
Done: Paulo Henrique de Lima Santana (phls) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-socketio, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Paulo Henrique de Lima Santana (phls) <[email protected]> (supplier of updated
python-socketio package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 03 Oct 2026 10:21:56 -0300
Source: python-socketio
Architecture: source
Version: 5.17.0-1
Distribution: unstable
Urgency: medium
Maintainer: Paulo Henrique de Lima Santana (phls) <[email protected]>
Changed-By: Paulo Henrique de Lima Santana (phls) <[email protected]>
Closes: 1144515
Changes:
python-socketio (5.17.0-1) unstable; urgency=medium
.
* New upstream version 5.17.0. (Closes: #1144515).
- Fix bugs reported on CVE-2026-48804.
* debian/control:
- Bumped Standards-Version to 4.7.4.
- Bumped debhelper to 14.
- Remove redundant priority optional field.
* debian/copyright:
- Added new upstream files to the list.
- Updated upstream and package copyright years.
* debian/manpage: updated manpage copied from upstream.
Checksums-Sha1:
01ec9b9a9feef111c90ccd5211eecb3a4490d0f3 2336 python-socketio_5.17.0-1.dsc
9b7671186b3a42f53d455127a9323a139723cb9a 134574
python-socketio_5.17.0.orig.tar.gz
5fc1da7160c825720e3f070af11ecfc4a62efe41 35528
python-socketio_5.17.0-1.debian.tar.xz
1861ffaeb406219f905e0d8cb282e3bbfee027d9 8030
python-socketio_5.17.0-1_source.buildinfo
Checksums-Sha256:
ade47a9d7dbaec7772518527aa6cbce168a849214f15b20b97cfabe487311082 2336
python-socketio_5.17.0-1.dsc
c3bbfc4937dcfea7c4d1b182afa94d4a30335d153987e8f2078b344beacf95a0 134574
python-socketio_5.17.0.orig.tar.gz
7ad7475bb0525517f013776bb10c72c043a79f8f0f286011b7736a75f2e45f89 35528
python-socketio_5.17.0-1.debian.tar.xz
e7a1c5f350f9957ccb94653877324f2c320acb170a87db379f1948174090d03d 8030
python-socketio_5.17.0-1_source.buildinfo
Files:
7e1b51c3d2de5c5e3310e711da614423 2336 python optional
python-socketio_5.17.0-1.dsc
dc6b5c68686cf88a4919e83fc0896719 134574 python optional
python-socketio_5.17.0.orig.tar.gz
b7ea5185ff79ea2ef221b6d35b1b723f 35528 python optional
python-socketio_5.17.0-1.debian.tar.xz
fcfee1b04fa68da9f8866dfda90c5783 8030 python optional
python-socketio_5.17.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEQySpKy57hdp/nJxAxm0GtARDxFAFAmrBDL0ACgkQxm0GtARD
xFDI3xAAqs/awaJMazyLTgWhmFejl8y+S4bRmI7PSa6cu2cYv1InL0U/hZzoN/Ct
zdwf0+rZzo0CXBk5zsGZTFhSxWjA6Sh2xVa6DPlPHC8Zeou2QtDcwwLbsSxmVDyV
76RqJo0tMFgzqTP/SAfWnB8l0FDFaWgJM0OMRwb4/S2DiHIuPco2HBWKc8OhiG8d
bL7H5EGI9yJvCEZGgYU/TorFNbrKw5tFDrlik9oW+mw09e0cAiqUDcWAaEHo1nwF
aS1Qdjf8XqN/exe0I5IT+EYfmeAEVMAihryuEN42We/5urjc1LBMXQWAfEw4PDum
+J6pJQbZfT9FcyfSidIZTdQcaQfyq1dNhIdmzniuotPXE01fekEH6iJuLtE0QoXT
2jZUGjWZUeZ3s+pQqM61A09DATQC9jXGgQbfXpiEAoW2GgDnmdjlzzh56wuc+bDu
uyyoBnGd3HwS3LY1wD9AtTUoQAGKmKNWDWrmOgQq6AUUgQL2Reei/bNBwj3mH63R
2TOJmHO9IUcrpSfUm+q9wI3jTmhJGG5MXuTxUyjv2JBf0FGaQuXSNKL3Uq/C1YHf
fIkqa7eLYhMoL16i5hd2z1iRbw6j4Jy9gN4/J9MO0wJ+6/GsJDiK79SwgB85aGDm
Vp/4Yu3RBodBhr0HptmcaFNsdVsW0ZXwELciZbHrUEp+5CVhQJQ=
=XN33
-----END PGP SIGNATURE-----
pgpHkQyjk5Cjm.pgp
Description: PGP signature
--- End Message ---
