pypi package report

Is websockets safe?

2 known vulnerabilities, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

2.3%

chance of exploitation in the next 30 days

xyz score

4.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-8ch4-58qp-g3mp, the advisory selected below

// advisories

GHSA-8ch4-58qp-g3mp

HIGHCVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactory(credentials=...). An attacker may be able to guess a password via a timing attack.

Affected: < 9.1
Fixed in: 9.1
Weakness: CWE-203
Published: 2021-06-11
Source: github

GHSA NVD MITRE reference reference reference reference

// dependencies

1 direct

// ai model usage

No published models are known to use this package.

Checked 2026-09-22 at 00:42 UTC. The most recent advisory here was published 2021-06-11. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is websockets safe? pypi package security report | CyberXYZ