~ / search / GHSA-rrc9-mx66-ffcm

GHSA-rrc9-mx66-ffcm

daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-44545

Packages

EcosystemPackageAffectedFixed in
PyPI daphne < 4.2.2 4.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

References

External links from the advisory. They lead to third-party sites.