https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:57:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-15312 bdu:2026-15312 https://cve.radiocsirt.org/vuln/bdu:2026-15312 https://cve.radiocsirt.org/vuln/euvd-2026-324409 EUVD-2026-324409 https://cve.radiocsirt.org/vuln/euvd-2026-324409 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44545 <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44545 https://cve.radiocsirt.org/vuln/ghsa-rrc9-mx66-ffcm <p><strong>Affected:</strong> PyPI: daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> <p><strong>Affected:</strong> PyPI: daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> https://cve.radiocsirt.org/vuln/ghsa-rrc9-mx66-ffcm https://cve.radiocsirt.org/vuln/pysec-2026-213 <p><strong>Affected:</strong> PyPI: daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> <p><strong>Affected:</strong> PyPI: daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> https://cve.radiocsirt.org/vuln/pysec-2026-213 https://cve.radiocsirt.org/vuln/rhsa-2026:50319 <p>eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers net/mail: golang: net/mail: Denial of Service via pathological email address parsing mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header daphne: daphne: Denial of Service via excessive WebSocket message size python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens python-pillow: Pillow: Denial of Service via crafted PCF font data python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow: Pillow: Native heap out-of-bounds write pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values</p> <p>eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers net/mail: golang: net/mail: Denial of Service via pathological email address parsing mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header daphne: daphne: Denial of Service via excessive WebSocket message size python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens python-pillow: Pillow: Denial of Service via crafted PCF font data python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file Pillow: Pillow: Native heap out-of-bounds write pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values</p> https://cve.radiocsirt.org/vuln/rhsa-2026:50319 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44545 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-daphne, Ubuntu:20.04:LTS: python-daphne, Ubuntu:22.04:LTS: python-daphne, Ubuntu:24.04:LTS: python-daphne, Ubuntu:25.10: python-daphne, Ubuntu:26.04:LTS: python-daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-daphne, Ubuntu:20.04:LTS: python-daphne, Ubuntu:22.04:LTS: python-daphne, Ubuntu:24.04:LTS: python-daphne, Ubuntu:25.10: python-daphne, Ubuntu:26.04:LTS: python-daphne</p> <p>daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn&#39;s WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44545