CVE-2018-1000518: websockets_project websockets Uncontrolled Resource Consumption
Vulnerability summary
CVE-2018-1000518 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in websockets_project websockets. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 26-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.
CVSS metrics
4 scores · 2 sources · 4 versionsEPSS trend
Probability
1.83%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundWebsockets
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Opensuse1 product
- python-websockets&distro=openSUSE Tumbleweed< 12.0-2.6 | < 16.0-2.1 | < 9.1-2.1
PyPI1 product
- websockets≥ 4.0, < 5.0 | < 5.0
Websockets_project1 product
- websockets4.0
3 vendors · 3 products
