CVE-2026-44545

7.5 highEPSS 0.3%

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2026-06-03
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Affected

djangoproject:daphne

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rrc9-mx66-ffcm	PyPI	daphne	<4.2.2	4.2.2
PYSEC-2026-213	PyPI	daphne	<4.2.2	4.2.2

References

https://github.com/django/daphne/blob/main/CHANGELOG.txt

Check your stack JSON