CVE-2026-44545 — Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

CVE-2026-44545

Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service PUBLISHED

Description (CNA)

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Affected (CNA)

Vendor / product	Versions
djangoproject / daphne	affected 4.2.0 through 4.2.1; unaffected 4.2.2

CWE

CWE-770

References

https://github.com/django/daphne/blob/main/CHANGELOG.txt

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.