The vulnerability CVE-2026-44545 in djangoproject daphne (version 4.2.0) is due to the absence of limits on WebSocket message and frame payload sizes. Specifically, daphne did not forward maxFramePayloadSize or maxMessagePayloadSize settings to Autobahn's WebSocketServerFactory, which defaults these limits to zero (meaning unlimited). This lack of throttling allows an unauthenticated remote attacker to send very large WebSocket messages or frames, leading to excessive memory use and denial of service conditions. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.

An unauthenticated remote attacker can exploit this vulnerability by sending arbitrarily large WebSocket messages or frames to a vulnerable daphne server, causing excessive memory consumption. This can result in denial of service by exhausting system resources, impacting the availability of the affected service. There is no impact to confidentiality or integrity as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the available data, users should monitor djangoproject advisories for updates. Until a fix is available, consider implementing external WebSocket message size limits or network-level protections to mitigate potential denial of service.