VULNERABILITY INTELLIGENCE

CVE-2026-44545

CVSS score5.3 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-06-03
Last modified2026-07-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Weakness classification

  • 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92: CWE-770

Primary references