CVE-2021-33880

5.9 mediumEPSS 2.3%

Medium (5.9). EPSS 2.3% chance of exploitation in the next 30 days. Fixed in websockets 9.1.

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-203
Published: 2021-06-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oracle:communications_cloud_native_core_policy
oracle:communications_cloud_native_core_security_edge_protection_proxy
oracle:communications_cloud_native_core_service_communication_proxy
oracle:communications_cloud_native_core_unified_data_repository
websockets_project:websockets

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-8ch4-58qp-g3mp	PyPI	websockets	<9.1	9.1
PYSEC-2021-95	PyPI	websockets	<9.1	9.1

References

Check your stack JSON