CVE-2026-44545 (GCVE-0-2026-44545)

Vulnerability from cvelistv5 – Published: 2026-06-03 13:17 – Updated: 2026-06-03 15:48
VLAI
Title
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Summary
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-03 15:48 UTC
CWE
  • CWE-770 - (Allocation of Resources Without Limits or Throttling)
Assigner
DSF
References
Impacted products
Vendor Product Version
djangoproject daphne Affected: 4.2.0 , ≤ 4.2.1 (python)
Unaffected: 4.2.2 (python)
Create a notification for this product.
Credits
ParkHyunWoo Carlton Gibson
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44545",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T15:48:33.527931Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T15:48:40.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/daphne/",
          "defaultStatus": "unaffected",
          "packageName": "daphne",
          "product": "daphne",
          "repo": "https://github.com/django/daphne/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThanOrEqual": "4.2.1",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "4.2.2",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ParkHyunWoo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Carlton Gibson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003edaphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn\u0027s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.\u003c/p\u003e"
            }
          ],
          "value": "daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn\u0027s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130: Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 (Allocation of Resources Without Limits or Throttling)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T13:17:42.907Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/django/daphne/blob/main/CHANGELOG.txt"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-18T03:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-05-06T03:00:00.000Z",
          "value": "Vulnerability confirmed."
        }
      ],
      "title": "Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-44545",
    "datePublished": "2026-06-03T13:17:42.907Z",
    "dateReserved": "2026-05-06T20:29:54.084Z",
    "dateUpdated": "2026-06-03T15:48:40.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44545",
      "date": "2026-08-15",
      "epss": "0.00328",
      "percentile": "0.25672"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44545\",\"sourceIdentifier\":\"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\",\"published\":\"2026-06-03T14:16:43.583\",\"lastModified\":\"2026-07-22T19:10:00.120\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn\u0027s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.\"},{\"lang\":\"es\",\"value\":\"daphne antes de la versi\u00f3n 4.2.2 no pasaba maxFramePayloadSize ni maxMessagePayloadSize a la WebSocketServerFactory de Autobahn. Debido a que Autobahn establece ambos valores por defecto en 0 (ilimitado), un atacante remoto no autenticado podr\u00eda enviar mensajes o tramas WebSocket arbitrariamente grandes, causando un consumo excesivo de memoria y una denegaci\u00f3n de servicio.\"}],\"affected\":[{\"source\":\"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\",\"affectedData\":[{\"vendor\":\"djangoproject\",\"product\":\"daphne\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pypi.org/project/daphne/\",\"packageName\":\"daphne\",\"repo\":\"https://github.com/django/daphne/\",\"versions\":[{\"version\":\"4.2.0\",\"lessThanOrEqual\":\"4.2.1\",\"versionType\":\"python\",\"status\":\"affected\"},{\"version\":\"4.2.2\",\"versionType\":\"python\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-03T15:48:33.527931Z\",\"id\":\"CVE-2026-44545\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:daphne:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.2.2\",\"matchCriteriaId\":\"48E446D3-9A77-40A0-A62A-D3F04DF924AB\"}]}]}],\"references\":[{\"url\":\"https://github.com/django/daphne/blob/main/CHANGELOG.txt\",\"source\":\"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\",\"tags\":[\"Release Notes\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-07T12:54:19+00:00",
      "cve": "CVE-2026-44545",
      "id": "CVE-2026-44545",
      "initial_release_date": "2026-06-03T13:17:42.907000+00:00",
      "product_status:fixed": "22",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "602",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "daphne: daphne: Denial of Service via excessive WebSocket message size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44545.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44545\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-03T15:48:33.527931Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-03T15:48:37.368Z\"}}], \"cna\": {\"title\": \"Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"ParkHyunWoo\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Carlton Gibson\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130: Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/django/daphne/\", \"vendor\": \"djangoproject\", \"product\": \"daphne\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2.0\", \"versionType\": \"python\", \"lessThanOrEqual\": \"4.2.1\"}, {\"status\": \"unaffected\", \"version\": \"4.2.2\", \"versionType\": \"python\"}], \"packageName\": \"daphne\", \"collectionURL\": \"https://pypi.org/project/daphne/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-18T03:00:00.000Z\", \"value\": \"Initial report received.\"}, {\"lang\": \"en\", \"time\": \"2026-05-06T03:00:00.000Z\", \"value\": \"Vulnerability confirmed.\"}], \"references\": [{\"url\": \"https://github.com/django/daphne/blob/main/CHANGELOG.txt\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn\u0027s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003edaphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn\u0027s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 (Allocation of Resources Without Limits or Throttling)\"}]}], \"providerMetadata\": {\"orgId\": \"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\", \"shortName\": \"DSF\", \"dateUpdated\": \"2026-06-03T13:17:42.907Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44545\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-03T15:48:40.018Z\", \"dateReserved\": \"2026-05-06T20:29:54.084Z\", \"assignerOrgId\": \"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92\", \"datePublished\": \"2026-06-03T13:17:42.907Z\", \"assignerShortName\": \"DSF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}