daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
02 / AFFECTED SOFTWARE
Affected packages
62 explicit affected versions
62 explicit affected versions
2 explicit affected versions
04 / EVIDENCE
Source records
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
05 / REFERENCES
Further evidence
- https://github.com/advisories/GHSA-rrc9-mx66-ffcm
- https://github.com/django/daphne/blob/main/CHANGELOG.txt
- https://github.com/django/daphne
- https://github.com/pypa/advisory-database/tree/main/vulns/daphne/PYSEC-2026-213.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2026-44545
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44545.json
- https://github.com/django/daphne/
- https://pypi.org/project/daphne/