CVE-2026-44545 | BDVDB-2026-337486 Detail
djangoprojectdaphne
Description#
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Impact#
CAPEC-130: Excessive Allocation
Weaknesses#
- CWE-770 (Allocation of Resources Without Limits or Throttling)
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.