CVE-2026-48809
HighAdvisory
Published 26 Jun 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.003
- 20th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 30
- of 17,781 indexed, latest versions
- Container images
- 28
- deployed by those charts
- Fix available
- 1 of 1
- affected package
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
Carried by container images the latest versions of 30 of 17,781 indexed charts deploy, on 28 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-engineiopypi | 3.0.0, 3.13.2, 3.14.2, 4.3.3+10 more | 4.13.2 | 28 |
- OSV records
- GHSA-m9gh-vj53-gvh9
- Also known as
- PYSEC-2026-3033
Charts affected
30 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| home-assistantgeek-cookbookVerified publisher | 13.5.0 | 1 of 1See more | 7,705 |
| homeassistantvolker-raschekVerified publisher | 0.2.3 | 1 of 1See more | 6,041 |
| openshift-secured-pgadmineximiaitVerified publisher | 0.2.0 | 1 of 2See more | 14,546 |
| home-assistantk8s-home-lab-repo | 16.3.1 | 1 of 1See more | 4,634 |
| rommcrystalnetVerified publisher | 0.2.20 | 1 of 3See more | 1,944 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 9,205 |
| appdaemongeek-cookbookVerified publisher | 8.4.2 | 1 of 1See more | 3,461 |
| iris-webappiris-webapp | 0.2.4 | 1 of 2See more | 11,764 |
| kuma-ingress-watcherkuma-ingress-watcherVerified publisher | 1.4.0 | 1 of 1See more | 2,662 |
| music-assistant-serverlmatfyVerified publisher | 0.1.9 | 1 of 1See more | 7,201 |
| pgadminappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 1,565 |
| pgadminarunalakmalVerified publisher | 0.1.0 | 1 of 1See more | 2,418 |
| swdpgadminarunalakmalVerified publisher | 0.1.0 | 1 of 1See more | 2,418 |
| locationprocessingassist-iot-location-processing | 1.0.0 | 1 of 3See more | 10,061 |
| kitchenowlchart-kitchenowl | 0.1.12 | 1 of 2See more | 4,803 |
| csghubcsghubVerified publisher | 2.4.3 | 1 of 34See more | 58,897 |
| home-assistantdamounVerified publisher | 1.1.0 | 1 of 1See more | 6,179 |
| wizarrdjjudas21Verified publisher | 0.1.5 | 1 of 1See more | 14,627 |
| rommernail-romm | 1.0.1 | 1 of 1See more | 2,896 |
| infrafibonacci-cluster-infraVerified publisher | 1.0.0 | 1 of 4See more | 12,454 |
| home-assistanthelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 4,647 |
| bazarrk8s-home-lab-repo | 11.3.2 | 1 of 1See more | 1,794 |
| beetsk8s-home-lab-repo | 3.1.1 | 1 of 1See more | 2,733 |
| music-assistantkarljorgensen | 0.1.3 | 1 of 1See more | 7,081 |
| home-assistantkfirfer | 0.5.4 | 1 of 1See more | 6,447 |
| elasticsearch2ncsaVerified publisher | 0.2.2 | 1 of 2See more | 4,911 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 4,749 |
| pgadminsb-helm-charts | 0.3.0 | 1 of 1See more | 1,713 |
| fantasy-dice-chambersudo-kraken-fantasy-dice-chamberVerified publisher | 0.1.3 | 1 of 1See more | 2,787 |
| simple-prima-notavcnngrVerified publisher | 0.5.3 | 1 of 4See more | 4,768 |
Container images carrying it
28 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | 781369df9994 | python-engineio | 4.13.2 | 3 |
| acockburn/ | 3a93281d7e94 | python-engineio | 4.13.2 | 1 |
| devopstales/ | 8bb837da5aec | python-engineio | 4.13.2 | 1 |
| dpage/ | 18cd5711fc9a | python-engineio | 4.13.2 | 1 |
| dpage/ | 37946e4f3e7b | python-engineio | 4.13.2 | 1 |
| dpage/ | 50700ac17936 | python-engineio | 4.13.2 | 1 |
| dpage/ | 52cb72a9e3da | python-engineio | 4.13.2 | 1 |
| dpage/ | 561c1f8f99f2 | python-engineio | 4.13.2 | 1 |
| elastichq/ | bb3bd22c2b87 | python-engineio | 4.13.2 | 1 |
| homeassistant/ | 021e2afc6e57 | python-engineio | 4.13.2 | 1 |
| homeassistant/ | 8d000332b09b | python-engineio | 4.13.2 | 1 |
| opencsghq/ | 2f03fead54db | python-engineio | 4.13.2 | 1 |
| rommapp/ | b909e95d1aab | python-engineio | 4.13.2 | 1 |
| tombursch/ | b48e4ab727cd | python-engineio | 4.13.2 | 1 |
| zurdi15/ | 2db88fe44c89 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | e59ebde55709 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 26c51e44d932 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | ec6d67fbedfa | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | feffc0b8227d | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 80cb090162b4 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | cc4975f1a0be | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 067e54e2e107 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 3522e8a7a8f0 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | eef3ee7810d0 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 14d45b2a1f00 | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | 99fd4cb0f4fe | python-engineio | 4.13.2 | 1 |
| ghcr.io/ | d19d886d5090 | python-engineio | 4.13.2 | 1 |