PT-2018-9415 · Aaugustin+1 · Uwebsockets+1
Aaugustin
·
Published
2018-06-26
·
Updated
2024-07-12
·
CVE-2018-1000518
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
aaugustin websockets versions 4.0 through 4.0
Description
The issue is related to improper handling of highly compressed data, which can result in Denial of Service by memory exhaustion. This can be exploited by sending a specially crafted frame on an established connection. The vulnerability appears to have been fixed in version 5.
Recommendations
For version 4, update to version 5 to resolve the issue.
As a temporary workaround, consider configuring the websockets library with compression=None to prevent exploitation.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Uwebsockets