{"id":"CVE-2026-44545","aliases":["GHSA-rrc9-mx66-ffcm","PYSEC-2026-213"],"title":"daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames","summary":"daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"daphne","product":"daphne","ecosystem":"pip","affected":["daphne < 4.2.2"],"patched":["daphne 4.2.2"],"published":"2026-06-03","updated":"2026-07-11","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rrc9-mx66-ffcm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44545"},{"url":"https://github.com/django/daphne"},{"url":"https://github.com/django/daphne/blob/main/CHANGELOG.txt"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/daphne/PYSEC-2026-213.yaml"}],"tags":["osv","pip"],"epss":0.00328,"epssPercentile":0.26033,"ingestedAt":"2026-07-12T18:57:28.026Z","slug":"CVE-2026-44545","body":"## Overview\n\ndaphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.\n\n## Affected packages\n\n- `daphne < 4.2.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `daphne 4.2.2`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}