Skip to content
OpenAdvisories

Package · PyPI

websockets

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.9
    CVE-2021-33880

    Observable Timing Discrepancy in aaugustin websockets library

    The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

    websockets python-websockets python-websockets Debian Ubuntu PyPI
  • High 7.5
    CVE-2018-1000518

    websockets is vulnerable to denial of service by memory exhaustion

    aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This a…

    websockets PyPI