CVE-2021-21419mediumCWE-400

CVE-2021-21419: falha de média gravidade em eventlet

Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar eventlet+ Monitorar eventlet

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 1.8%
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
eventlet · eventlet
CVEs relacionadas — eventlet

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58068MEDIUMEventlet affected by HTTP request smuggling in unparsed trailersEPSS 0.4%