CVE-2026-44545: Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
daphneto a version that resolves this vulnerability.Fixed in 4.2.2 - Configuration
Pass maxFramePayloadSize and maxMessagePayloadSize to Autobahn's WebSocketServerFactory (do not leave defaults of 0/unlimited) to limit WebSocket frame and message sizes
Autobahn WebSocketServerFactory maxFramePayloadSize, maxMessagePayloadSize = set to appropriate non-zero limits
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44545?
The severity of CVE-2026-44545 is medium with a score of 5.3.
How do I fix CVE-2026-44545?
To fix CVE-2026-44545, update daphne to version 4.2.2 or later.
What does CVE-2026-44545 affect?
CVE-2026-44545 affects daphne versions prior to 4.2.2.
What kind of attack does CVE-2026-44545 allow?
CVE-2026-44545 allows an unauthenticated remote denial of service attack due to unbounded WebSocket message and frame sizes.
What are the potential consequences of CVE-2026-44545?
The potential consequence of CVE-2026-44545 is excessive memory consumption, leading to a denial of service.