CVE-2026-44545
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
5.3 MediumFix available
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
0.33%Up 0.3 points since Jun 4, 2026
What each source reports
CVE List Score used
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
CVE-2026-44545- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-34091
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
EUVD-2026-34091- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rrc9-mx66-ffcm
daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
GHSA-rrc9-mx66-ffcm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
CVE-2026-44545- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
ALPINE-CVE-2026-44545- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
CVE-2026-44545- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
DEBIAN-CVE-2026-44545- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-rrc9-mx66-ffcm
daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
GHSA-rrc9-mx66-ffcm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVPYSEC-2026-213
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
PYSEC-2026-213- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:50319
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:50319- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:50336
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:50336- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59136
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:59136- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Record
UBUNTU-CVE-2026-44545- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
daphnePyPI |
before 4.2.2 | 4.2.2 |
py3-daphneAlpine:v3.24 |
before 4.2.3-r0 | 4.2.3-r0 |
python-daphneDebian:12 |
All versions, plus listed versions 4.0.0-14.1.2-14.1.2-24.2.1-14.2.1-24.2.2-0.14.2.3-1 |
None known |
python-daphneDebian:13 |
before 4.1.2-2+deb13u1, plus listed versions 4.1.2-2 |
4.1.2-2+deb13u1 |
python-daphneDebian:14 |
before 4.2.2-0.1, plus listed versions 4.1.2-24.2.1-14.2.1-2 |
4.2.2-0.1 |
daphnePyPI |
before 4.2.2, plus listed versions 0.10.00.10.10.10.20.10.30.11.0 Show 45 moreShow less0.11.10.11.20.11.30.12.00.12.10.12.20.13.00.13.10.14.00.14.10.14.20.14.30.15.00.8.10.8.20.90.9.10.9.20.9.31.0.01.0.11.0.21.0.31.1.01.2.01.3.01.4.01.4.11.4.22.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.2.02.2.12.2.22.2.32.2.42.2.52.3.02.4.0 |
4.2.2 |
automation-eda-controllerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el8ap | 0:1.1.21-1.el8ap |
automation-eda-controller-baseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el8ap | 0:1.1.21-1.el8ap |
automation-eda-controller-base-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el8ap | 0:1.1.21-1.el8ap |
automation-eda-controller-event-stream-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el8ap | 0:1.1.21-1.el8ap |
Show 97 moreShow less
| Package | Affected | Fixed |
|---|---|---|
automation-eda-controller-worker-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el8ap | 0:1.1.21-1.el8ap |
automation-eda-controllerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el9ap | 0:1.1.21-1.el9ap |
automation-eda-controller-baseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el9ap | 0:1.1.21-1.el9ap |
automation-eda-controller-base-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el9ap | 0:1.1.21-1.el9ap |
automation-eda-controller-event-stream-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el9ap | 0:1.1.21-1.el9ap |
automation-eda-controller-worker-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.1.21-1.el9ap | 0:1.1.21-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:2.5.10-7.el8ap | 0:2.5.10-7.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:3.14.1-2.el8ap | 0:3.14.1-2.el8ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:3.14.1-2.el9ap | 0:3.14.1-2.el9ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:2.5.10-7.el8ap | 0:2.5.10-7.el8ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:2.5.10-7.el8ap | 0:2.5.10-7.el8ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:2.5.10-7.el8ap | 0:2.5.10-7.el8ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el8ap | 0:1.6.7-1.el8ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
python3.12-daphneRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:4.2.2-1.el8ap | 0:4.2.2-1.el8ap |
python3.12-daphneRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:4.2.2-1.el9ap | 0:4.2.2-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:4.6.31-1.el8ap | 0:4.6.31-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:4.6.31-1.el9ap | 0:4.6.31-1.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:12.3.0-1.el8ap | 0:12.3.0-1.el8ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:12.3.0-1.el9ap | 0:12.3.0-1.el9ap |
python3.12-pyasn1Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 17 CVEs |
before 0:0.6.4-1.el8ap | 0:0.6.4-1.el8ap |
python3.12-pyasn1Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 17 CVEs |
before 0:0.6.4-1.el9ap | 0:0.6.4-1.el9ap |
automation-eda-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.2.11-1.el9ap | 0:1.2.11-1.el9ap |
automation-eda-controller-baseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.2.11-1.el9ap | 0:1.2.11-1.el9ap |
automation-eda-controller-base-servicesRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.2.11-1.el9ap | 0:1.2.11-1.el9ap |
automation-eda-controller-event-stream-servicesRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.2.11-1.el9ap | 0:1.2.11-1.el9ap |
automation-eda-controller-worker-servicesRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.2.11-1.el9ap | 0:1.2.11-1.el9ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:2.6.17-2.el9ap | 0:2.6.17-2.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:3.14.1-2.el9ap | 0:3.14.1-2.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:3.14.1-2.el9ap | 0:3.14.1-2.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:3.14.1-2.el9ap | 0:3.14.1-2.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el10ap | 0:1.6.7-1.el10ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el10ap | 0:1.6.7-1.el10ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el10ap | 0:1.6.7-1.el10ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el10ap | 0:1.6.7-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:1.6.7-1.el9ap | 0:1.6.7-1.el9ap |
python3.12-daphneRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.2.2-1.el9ap | 0:4.2.2-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:4.7.15-2.el9ap | 0:4.7.15-2.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:12.3.0-1.el9ap | 0:12.3.0-1.el9ap |
python3.12-pillow-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:12.3.0-1.el9ap | 0:12.3.0-1.el9ap |
python3.12-pillow-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:12.3.0-1.el9ap | 0:12.3.0-1.el9ap |
python3.12-pyasn1Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 17 CVEs |
before 0:0.6.4-1.el9ap | 0:0.6.4-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:2.6.13-1.el9ap | 0:2.6.13-1.el9ap |
python-djangoRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python-djangoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.1.59-1.el9ap | 0:3.1.59-1.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python-daphneUbuntu:18.04:LTS |
All versions, plus listed versions 1.4.2-1 |
None known |
python-daphneUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.0-12.4.0-12.4.1-1 |
None known |
python-daphneUbuntu:22.04:LTS |
All versions, plus listed versions 3.0.1-13.0.2-1 |
None known |
python-daphneUbuntu:24.04:LTS |
All versions, plus listed versions 4.0.0-1 |
None known |
python-daphneUbuntu:25.10 |
All versions, plus listed versions 4.1.2-2 |
None known |
python-daphneUbuntu:26.10 |
All versions, plus listed versions 4.2.1-24.2.2-0.14.2.3-1 |
None known |
python-daphneUbuntu:26.04:LTS |
All versions, plus listed versions 4.1.2-24.2.1-14.2.1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44545 is a medium vulnerability (CVSS 5.3) in Djangoproject Daphne, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in daphne 4.2.2.
References
github.com/django/daphne/blob/main/CHANGELOG.txt
nvd.nist.gov/vuln/detail/CVE-2026-44545
security.alpinelinux.org/vuln/CVE-2026-44545
Show 194 moreShow less
pypi.org/project/daphne
security-tracker.debian.org/tracker/CVE-2026-44545
access.redhat.com/errata/RHSA-2026:50319
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
bugzilla.redhat.com/show_bug.cgi?id=2467822
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50319.json
cve.org/CVERecord?id=CVE-2026-12383
go.dev/cl/783621
groups.google.com/g/golang-announce/c/tKs3rmcBcKw
pkg.go.dev/vuln/GO-2026-5037
cwe.mitre.org/data/definitions/93.html
html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs.com/package/form-data
docs.djangoproject.com/en/dev/releases/security
djangoproject.com/weblog/2026/aug/04/security-releases
vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from
ubuntu.com/security/CVE-2026-44545
This page doesn't list everything
Left out here: 12 versions and 36 references. The JSON record has them.