High [CVE-2026-48804] Denial of Service via binary attachment accumulation

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments.

Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time.

Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.

This causes the incomplete messages to persist in memory, leading to excessive memory consumption and ultimately a Denial of Service (DoS) for the server. A denial of service flaw exists in python-socketio's binary packet assembly mechanism.

An unauthenticated remote attacker can submit binary headers while deliberately withholding attachment streams, causing untracked memory accumulation until memory exhaustion occurs. When python-socketio processes unauthenticated websocket connections, malformed payload streams can degrade or crash the service, posing an Important impact to availability.