pypi package report

Is daphne safe?

2 known vulnerabilities, worst severity MODERATE.

// reach

13 direct dependencies

5 carry known advisories, worst CRITICAL

6 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
5.3
medium

CVSS v3.1 base score out of 10

epss
0.33%
low

chance of exploitation in 30 days, 26th percentile of all CVEs

xyz score
not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-rrc9-mx66-ffcm, the advisory selected below

// 2 advisories

GHSA-rrc9-mx66-ffcm

MODERATEGitHub ratingCVE-2026-44545

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Checked 2026-11-06 at 21:55 UTC. The most recent advisory here was published 2026-06-03. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.