CVE-2018-1000518: websockets Denial of Service Vulnerability
Summary
CVE-2018-1000518: aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial... Affects websockets versions < 5.0. Fixed in 5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The websockets package is a Python library that provides a high-level API for implementing WebSocket servers and clients. It allows for real-time communication between a client and a server over a single, long-lived connection. The package is widely used in various Python applications for enabling WebSocket functionality.
Vulnerability Detail
The websockets version 4 is vulnerable to a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. This vulnerability allows an attacker to cause a Denial of Service (DoS) condition by sending a specially crafted frame on an established connection. The vulnerability arises due to improper handling of highly compressed data, which can lead to memory exhaustion. The impact of this vulnerability can result in the unavailability of the WebSocket server or client, disrupting real-time communication.
How To Fix
Latest published version: 17.3.0 as of 22 Oct 2026
pip install --upgrade "websockets==17.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0
This is the first release that contains the fix.
pip install --upgrade "websockets==5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 5 is not feasible, a workaround is to configure the websockets package with compression=None. This can be done by modifying the configuration settings of the WebSocket server or client to disable compression. By disabling compression, the vulnerability can be mitigated as the improper handling of highly compressed data will no longer be a concern.
Conclusion
The websockets package version 4 is vulnerable to a Denial of Service (DoS) vulnerability due to improper handling of highly compressed data. To mitigate this vulnerability, it is recommended to upgrade to websockets version 5 or later. Alternatively, configuring the package with compression=None can serve as a workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for websockets →
FAQ
The vulnerability can result in a Denial of Service (DoS) condition by causing memory exhaustion. This can lead to the unavailability of the WebSocket server or client, disrupting real-time communication.
To fix the vulnerability, it is recommended to upgrade the websockets package to version 5 or later. Alternatively, you can configure the package with compression=None to mitigate the vulnerability.
Yes, a workaround is to configure the websockets package with compression=None. This can be done by modifying the configuration settings of the WebSocket server or client to disable compression.
Yes, the vulnerability has been fixed in websockets version 5.
You can find more information about this vulnerability in the official advisory database of the PyPA (Python Packaging Authority).
References
Related vulnerabilities
Recent vulnerabilities recorded for websockets.
