CVE-2026-44545: daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

June 3, 2026 (updated July 11, 2026)

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn’s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

References

github.com/advisories/GHSA-rrc9-mx66-ffcm
github.com/django/daphne/blob/main/CHANGELOG.txt
github.com/pypa/advisory-database/tree/main/vulns/daphne/PYSEC-2026-213.yaml
nvd.nist.gov/vuln/detail/CVE-2026-44545

Code Behaviors & Features

Detect and mitigate CVE-2026-44545 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →