CVE-2026-44546
Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.
| CWE | CWE-444 |
| Vendor | djangoproject |
| Product | daphne |
| Published | Jun 3, 2026 |
| Last Updated | Jun 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for djangoproject daphne
Be the first to know when new low vulnerabilities affecting djangoproject daphne are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
djangoproject / daphne
4.2.0 ≤ 4.2.1
References
Credits
🔍 Rene Henningsen Carlton Gibson