What’s Vulnerable › Vulnerabilities
CVE-2026-44546: Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-03 · updated 2026-07-22
- Weakness: CWE-444
Description
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.
Affected products
- djangoproject daphne: before 4.2.2 — fixed in 4.2.2
How to fix
Upgrade to a fixed version: djangoproject daphne 4.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44546 or the next vulnerability affects your stack