SUSE-SU-2026:3085-1

HIGH7.5

Security update for python-python-engineio

Published Jul 16, 2026

Modified 1 weeks ago

Fix available

Details

Description of the patch:

This update for python-python-engineio fixes the following issues:

CVE-2026-48802: remote user can cause the creation of unnecessary background threads in the server through the heartbeat mechanism and cause a DoS (bsc#1269544).
CVE-2026-48809: size of incoming messages is not checked before they are loaded into memory and allows remote users to cause a DoS via excessive memory allocation (bsc#1269545).

Affected Packages

python311-python-engineio

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Python 3 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

4.3.4-150600.3.3.1

References

ADVISORY

https://bugzilla.suse.com/1269544

ADVISORY

https://bugzilla.suse.com/1269545

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-July/048414.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-48802/

ADVISORY