GHSA-6g87-ff9q-v847
websockets is vulnerable to denial of service by memory exhaustion
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | websockets | >= 4.0, < 5.0 | 5.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0
References
External links from the advisory. They lead to third-party sites.