CVE-2021-33880: Timing Attack Vulnerability in websockets
Summary
CVE-2021-33880: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). Affects websockets across 2 version ranges.
< 9.1
< 547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
Fixed in 547a26b685d08cac0aa64e5e65f7867ac0ea9bc0. How to fix ↓
Also tracked for
- python-websockets · Debian:11
The same CVE-2021-33880 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The websockets library is a popular Python package available on PyPI. It provides a high-level API for implementing WebSocket servers and clients. WebSocket is a communication protocol that enables bidirectional communication between a client and a server over a single, long-lived connection. The websockets library is widely used in various applications for real-time communication and data streaming.
Vulnerability Detail
The websockets library before version 9.1 is vulnerable to an Observable Timing Discrepancy when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). This vulnerability allows an attacker to guess a password through a timing attack. By carefully measuring the time it takes for the server to respond to authentication attempts, an attacker can infer the correctness of the password and potentially gain unauthorized access to the system. This vulnerability can have serious security implications, as it undermines the confidentiality and integrity of the system's authentication mechanism.
How To Fix
Latest published version: 17.3.0 as of 22 Oct 2026
pip install --upgrade "websockets==17.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
This is the first release that contains the fix.
pip install --upgrade "websockets==547a26b685d08cac0aa64e5e65f7867ac0ea9bc0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to websockets version 9.1 or later.
Conclusion
The websockets library before version 9.1 is vulnerable to a timing attack that allows an attacker to guess passwords when HTTP Basic Authentication is enabled. This can lead to unauthorized access and potential misuse of the system. To mitigate this vulnerability, it is crucial to upgrade to websockets version 9.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for websockets →
FAQ
This vulnerability allows an attacker to guess a password through a timing attack. If successfully exploited, an attacker can gain unauthorized access to the system and potentially perform malicious actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to websockets version 9.1 or later.
The only effective mitigation for this vulnerability is to upgrade to websockets version 9.1 or later. It is recommended to promptly apply the fix to ensure the security of your application.
There is no information available regarding exploitation of this vulnerability in the wild. However, it is always recommended to stay updated with the latest security patches and apply them as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for websockets.
