AIKIDO-2026-11079
daphne is vulnerable to Allocation of Resources Without Limits or Throttling
53
Medium Risk
This Affects:
daphneTL;DR
Daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
daphne is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.9.3 - 4.2.1.
How to fix this
Upgrade the daphne library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant