CVE-2026-44545— Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| djangoproject | daphne | 4.2.0≤ 4.2.1 | affected |
4.2.2 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44545
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
daphne 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
daphne是Django开源的一个支持HTTP、HTTP2和WebSocket的ASGI协议服务器。 daphne 4.2.2之前版本存在安全漏洞，该漏洞源于未传递最大帧或消息有效载荷大小，可能导致未经身份验证的远程攻击者发送任意大的WebSocket消息，造成过度内存消耗和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| djangoproject | daphne | 4.2.0 ~ 4.2.1 | - |
II. Public POCs for CVE-2026-44545
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44545
请登录查看更多情报信息。
Same Patch Batch · djangoproject · 2026-06-03 · 7 CVEs total
| CVE-2026-44546 | 3.7 LOW | Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofi |
| CVE-2026-7666 | 3.1 LOW | Potential unencrypted email transmission via STARTTLS in the SMTP backend |
| CVE-2026-48587 | 3.1 LOW | Potential exposure of private data via whitespace padding in Vary header |
| CVE-2026-35193 | 3.1 LOW | Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewar |
| CVE-2026-6873 | 3.1 LOW | Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie |
| CVE-2026-8404 | 3.1 LOW | Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCa |
IV. Related Vulnerabilities
Same vendor: djangoproject
- CVE-2026-15920
Potential cross-site scripting via URLField values in the ad - CVE-2026-15830
Potential denial-of-service vulnerability via nested geometr - CVE-2026-15337
Potential denial-of-service vulnerability in check_for_langu - CVE-2026-15307
Server-side file-write and request forgery via spatial looku - CVE-2026-53878
Header injection possibility since DomainNameValidator accep
Same weakness: CWE-770
- CVE-2026-14514
Reliable Scalable Cluster Technology Denial-of-Service - CVE-2026-61712
BuildKit: Possible runtime DoS via unbounded group parsing - CVE-2026-49870
Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting - CVE-2026-73541
Tempo fee sponsorship in mpp bounds each transaction but not - CVE-2026-20177
Cisco Industrial Ethernet 1000 Series Switches Denial of Ser
V. Comments for CVE-2026-44545
No comments yet