CVE-2018-1000518: websockets is vulnerable to denial of service by memory exhaustion

September 17, 2018 (updated November 19, 2024)

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0

References

github.com/aaugustin/websockets
github.com/aaugustin/websockets/pull/407
github.com/advisories/GHSA-6g87-ff9q-v847
github.com/pypa/advisory-database/tree/main/vulns/websockets/PYSEC-2018-79.yaml
nvd.nist.gov/vuln/detail/CVE-2018-1000518

Code Behaviors & Features

Detect and mitigate CVE-2018-1000518 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →