daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
References
| Link | Resource |
|---|---|
| https://github.com/django/daphne/blob/main/CHANGELOG.txt | Release Notes |
Configurations
History
15 Jun 2026, 19:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/django/daphne/blob/main/CHANGELOG.txt - Release Notes | |
| First Time |
Djangoproject daphne
Djangoproject |
|
| CPE | cpe:2.3:a:djangoproject:daphne:*:*:*:*:*:*:*:* |
03 Jun 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-03 14:16
Updated : 2026-06-15 19:53
NVD link : CVE-2026-44545
Mitre link : CVE-2026-44545
CVE.ORG link : CVE-2026-44545
JSON object : View
Products Affected
djangoproject
- daphne
CWE
CWE-770
Allocation of Resources Without Limits or Throttling