PatchTheCVEdaphne vulnerabilities and fixes
Recent CVEs affecting daphne, with upgrade or downgrade steps. 2 tracked.
daphne has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-06-03. Highest priority: CVE-2026-44545 (score 30/100).
- CVE-2026-44545 MEDIUM 5.3 UPGRADE daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFac
- CVE-2026-44546 LOW 3.7 UPGRADE daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for
FAQ
How do I fix daphne vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is daphne being exploited right now?
None of the tracked daphne CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which daphne CVE should I patch first?
CVE-2026-44545 currently ranks highest (30/100): daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFac.