The vulnerability is a limitation in Daphne’s WebSocket handling where, before version 4.2.2, Daphne did not forward the configured maximum frame or message payload sizes to Autobahn’s WebSocketServerFactory. Autobahn defaults both limits to zero, meaning unlimited sizes. Consequently an unauthenticated attacker could send extremely large WebSocket frames or messages, causing Daphne to allocate excessive memory and eventually become unresponsive, which is a classic denial of service scenario. This flaw is categorized as CWE‑770: Excessive Resource Consumption.

The vulnerable product is Daphne, part of the Django project. All releases prior to 4.2.2 are affected. The specific product name is "Django Daphne" and the vendor identifier is djangoproject:daphne. No other vendors or product lines are impacted.

The CVSS score is 5.3, indicating a medium severity risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, which suggests it is currently unproven or limited in exploit usage. The attack vector is likely an unauthenticated remote user establishing a WebSocket connection and sending oversized frames or messages. Achieving the denial requires only the ability to send data to a running Daphne instance; no authentication or privileged access is needed.