CVE-2021-21419: Eventlet WebSocket Frame Exhaustion
Summary
CVE-2021-21419: Eventlet is a concurrent networking library for Python. Affects eventlet versions >= 0.10.0, < 0.31.0. Fixed in 0.31.0. How to fix ↓
Also tracked for
- python-eventlet · Debian:11
The same CVE-2021-21419 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eventlet is a concurrent networking library for Python that enables high-performance networking applications. It provides a simple and efficient way to handle concurrency and asynchronous I/O. The library includes support for WebSocket communication, allowing bidirectional communication between clients and servers. However, a vulnerability in Eventlet's WebSocket implementation can lead to memory exhaustion on the server side when processing large or highly compressed WebSocket frames.
Vulnerability Detail
The vulnerability (CVE-2021-21419) arises from the lack of proper limits on the size of WebSocket frames in Eventlet versions prior to 0.31.0. An attacker can exploit this by sending excessively large WebSocket frames, causing the server to exhaust its memory resources. Additionally, a malicious peer can send highly compressed data frames to achieve the same effect. This vulnerability can result in denial-of-service (DoS) conditions, impacting the availability and performance of the affected Eventlet process.
How To Fix
Latest published version: 0.41.3 as of 23 Oct 2026
pip install --upgrade "eventlet==0.41.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.0
This is the first release that contains the fix.
pip install --upgrade "eventlet==0.31.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict memory usage via operating system limits to mitigate the impact of this vulnerability. However, this workaround only addresses overall machine exhaustion and does not provide protection specifically for the Eventlet process. It is strongly advised to apply the official patch by upgrading to a fixed version of Eventlet.
Conclusion
The vulnerability in Eventlet's WebSocket implementation (CVE-2021-21419) can lead to memory exhaustion on the server side, potentially resulting in denial-of-service conditions. To mitigate this risk, it is crucial to upgrade to Eventlet version 0.31.0 or later, which includes a patch that restricts the size of WebSocket frames. Applying the official fix will ensure the stability and security of Eventlet-based applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for eventlet →
FAQ
Eventlet is a concurrent networking library for Python that enables high-performance networking applications. It provides a simple and efficient way to handle concurrency and asynchronous I/O.
The vulnerability can lead to memory exhaustion on the server side, potentially causing denial-of-service (DoS) conditions and impacting the availability and performance of the affected Eventlet process.
To fix this vulnerability, it is recommended to upgrade to Eventlet version 0.31.0 or later, which includes a patch that restricts the size of WebSocket frames.
A temporary workaround is to restrict memory usage via operating system limits. However, this workaround only addresses overall machine exhaustion and does not provide specific protection for the Eventlet process. It is advisable to apply the official patch by upgrading to a fixed version of Eventlet.
For more information about this vulnerability, you can refer to the official advisory in the Python Package Index (PyPI) advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/eventlet/PYSEC-2021-12.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for eventlet.
