CVE-2026-44545: Daphne WebSocket Denial of Service via Unlimited Payload Size

Technical summary

The vulnerability stems from missing parameter propagation in Daphne's WebSocket initialization. When Daphne instantiates Autobahn's WebSocketServerFactory, it does not pass the maxFramePayloadSize and maxMessagePayloadSize parameters. Autobahn interprets absent parameters as zero (unlimited), creating an unbounded memory allocation condition. An unauthenticated remote attacker can exploit this by sending crafted WebSocket frames or multi-frame messages of arbitrary size. Each oversized message triggers memory allocation on the server, leading to resource exhaustion and denial of service without requiring authentication, network-layer filtering, or user interaction.

Business impact

Applications using vulnerable Daphne versions that expose WebSocket endpoints face availability risk. A remote attacker can crash or severely degrade the application server, impacting all users relying on that service. This is particularly concerning for real-time applications (chat, notifications, live dashboards) that depend on WebSocket stability. Unlike vulnerabilities requiring authentication, this flaw is exploitable immediately upon network exposure, making it a practical attack vector for adversaries conducting service disruption campaigns.

Affected systems

Daphne versions prior to 4.2.2 are affected. Daphne is commonly deployed in Django environments, particularly in production setups using container orchestration or cloud platforms. Any organization running an older Daphne release with publicly or internally exposed WebSocket endpoints should be considered at risk. The vulnerability is network-based and requires no local access or special privileges to trigger.

Exploitability

Exploitability is straightforward. The attack requires only network access to the WebSocket endpoint—no authentication, no special configuration, no user interaction. An attacker can craft WebSocket frames exceeding typical memory limits using readily available tools and libraries. The low attack complexity and high accessibility make this a practical concern for internet-facing applications. However, the impact is limited to availability (memory exhaustion), not confidentiality or integrity, which moderates the overall severity.

Remediation

Upgrade Daphne to version 4.2.2 or later. The patched version properly passes payload size limits to Autobahn's WebSocketServerFactory, enabling the framework's built-in memory protections. Organizations should prioritize this upgrade for any Daphne deployment serving real-time or WebSocket-dependent applications. After upgrading, verify that payload limits are appropriately configured for your application's use case and monitor WebSocket connection metrics to detect potential attack attempts.

Patch guidance

Update to Daphne 4.2.2 or newer. Consult the official Daphne release notes and Django deployment documentation for upgrade procedures specific to your environment (pip, Docker, container orchestration, etc.). Test the upgrade in a staging environment first, particularly if you have applications with legitimate high-volume WebSocket traffic, to ensure the new payload limits do not interfere with normal operation. Verify the configuration after upgrade and consider implementing additional network-layer rate limiting or WAF rules for WebSocket endpoints as defense-in-depth.

Detection guidance

Monitor for unusual memory consumption or crashes in Daphne processes following WebSocket connection activity. Log WebSocket frame and message sizes at the application level if possible, and alert on messages exceeding expected thresholds. Network-based detection is challenging because the attack uses valid WebSocket protocol framing; focus on behavioral indicators such as rapid memory growth, process restarts, or connection timeouts. Check running Daphne versions using pip show or container image inspection to identify vulnerable deployments. Consider adding payload size validation at the application layer as a temporary measure until patching is complete.

Why prioritize this

Despite the MEDIUM severity rating, this vulnerability warrants near-term attention because it affects availability in real-time applications and requires no authentication or special configuration to exploit. Internet-facing WebSocket endpoints are directly exposed to unauthenticated attack. The fix is straightforward (a version upgrade) and carries low regression risk. Organizations should prioritize patching any production WebSocket services before patching lower-impact vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the attack vector (network), low complexity, no privilege requirement, and no user interaction—all favoring exploitability. However, the impact is constrained to availability (memory exhaustion leading to denial of service), with no confidentiality or integrity compromise. The score appropriately reflects a practical but limited-scope threat. In context of WebSocket-dependent applications, organizations may apply additional business risk multipliers (service criticality, customer exposure) to justify accelerated patching.

Frequently asked questions