CVE-2021-21419
mediumpriority · track · 22EPSS 0.018 · 78 %ileDEEURUUSEPSS · scored 2026-10-27
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (22)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-0395Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-02-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.
- WID-SEC-W-2024-0103Red Hat OpenStack: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-12-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenStack ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-9p9m-jm8w-94p2Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet2021-05-07ghsa · osvUS
### Impact A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. ### Patches Version 0.31.0 restricts websocket frame to reasonable limits. ### Workarounds Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process. ### For more information If you have any questions or comments about this advisory: * Open an issue in [eventlet](https://github.com/eventlet/eventlet/issues) * Contact current maintainers. At 2021-03: temotor@gmail.com or https://t.me/temotor
- PYSEC-2021-122021-05-07vendor · osvUS
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (24)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2021-21419cnnvd
- https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB/cnnvd
- https://packetstormsecurity.com/files/162602/Ubuntu-Security-Notice-USN-4956-1.htmlcnnvd
- https://packetstormsecurity.com/files/163688/Red-Hat-Security-Advisory-2021-2437-01.htmlcnnvd
- https://packetstormsecurity.com/files/163957/Red-Hat-Security-Advisory-2021-3361-01.htmlcnnvd
- https://packetstormsecurity.com/files/165228/Red-Hat-Security-Advisory-2021-5071-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan