CVE-2026-44545

MediumCVSS 5.3

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Daphne before version 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Since Autobahn defaults both to 0 (unlimited), an unauthenticated remote attacker can send arbitrarily large WebSocket frames or messages, causing excessive memory consumption and denial of service.

Risk Assessment

A DoS attack can crash the WebSocket server, disrupting real-time application functionality.

Recommendation

Upgrade Daphne to version 4.2.2 or later.

Other vulnerabilities in Daphne

CVE-2026-44546Low
Daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

Original NVD description (English source)

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS