GitHub Advisoryadvisory · PyPI

GHSA-rrc9-mx66-ffcm daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

MEDIUM Published 2026-06-03 Modified 2026-07-11 Official page ↗
Aliases
CVE-2026-44545
Ecosystem
PyPI
Packages
daphne
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2026-07-11

Affected packages

• PyPI daphne: < 4.2.2 → fixed in 4.2.2

Description

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Related

Alias · CVE (1)

  • CVE-2026-44545 daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References