CVE-2018-1000518

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 26, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-10005196.5aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-liCVE-2018-10005207.5ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_CVE-2018-10005216.1BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vuCVE-2018-10005238.1topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of dCVE-2018-10005245.5miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result inCVE-2018-10005259.8openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information dCVE-2018-10005267.5Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear toCVE-2018-10005277.2Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information discloCVE-2018-10005286.1GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change paCVE-2018-10005296.1Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . ThiCVE-2018-10005317.5inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode thCVE-2018-10005324.7beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivile