The daphne server in djangoproject prior to version 4.2.2 fails to enforce limits on WebSocket message and frame sizes because it does not pass maxFramePayloadSize or maxMessagePayloadSize parameters to the underlying Autobahn WebSocketServerFactory. Autobahn defaults these values to 0, meaning unlimited size. This lack of throttling allows unauthenticated remote attackers to send very large WebSocket messages or frames, leading to excessive memory use and denial of service conditions. No official patch or remediation level is currently documented for this vulnerability.

An unauthenticated remote attacker can exploit this vulnerability by sending arbitrarily large WebSocket messages or frames to a vulnerable daphne server, causing excessive memory consumption. This can result in denial of service, impacting availability of the affected service. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external WebSocket message size limits or deploying network-level protections to mitigate large payload attacks. Monitor for vendor updates regarding a patch or official mitigation.