CVEvulnerability
CVE-2026-44545
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-06-03
- Last modified
- 2026-07-22
- Assigner
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- CVSS 3.1 (6a34fbeb-21d4-45e7-8e0a-62b95bc12c92)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
Description
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Affected configurations
• djangoproject daphne (< 4.2.2)
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/django/daphne/blob/main/CHANGELOG.txt Release Notes