Daphne WebSocket Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Daphne versions prior to 4.2.2. The issue arises because Daphne did not impose limits on WebSocket message or frame sizes, allowing an unauthenticated remote attacker to send excessively large WebSocket messages or frames. This lack of restriction led to significant memory consumption on the server, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability could lead to excessive memory usage on the server, causing a denial-of-service condition where the server becomes unresponsive or unavailable.

Remediation

Users can upgrade to Daphne version 4.2.2 or later, where this vulnerability has been fixed. Instructions for updating can be found in the project's GitHub repository.