VYPR
← All advisories
Moderate severityNVD Advisory· Published May 7, 2021· Updated Aug 3, 2024

Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

CVE-2021-21419

Description

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
eventletPyPI
>= 0.10, < 0.31.00.31.0

Affected products

153

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.