Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-44545 daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory

Description

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

Produits et versions touchés

Produit Versions touchées Corrigé en
daphne 4.2 4.2.0 → 4.2.1 4.2.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de daphne

Les 2 CVE de daphne →
CVE-2026-44546 daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket… 3.7 Faible
Suivre cette CVE