CVE-2026-44546: Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
daphneto a version that resolves this vulnerability.Fixed in 4.2.2 - Configuration
Ensure daphne is updated so it rejects WebSocket upgrade requests with header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85, responding with HTTP 400.
daphne reject requests containing bytes in any header value = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44546?
The severity of CVE-2026-44546 is classified as low, with a score of 3.7.
How do I fix CVE-2026-44546?
To fix CVE-2026-44546, update daphne to version 4.2.2 or later.
What is the impact of CVE-2026-44546?
CVE-2026-44546 allows for header injection via the WebSocket upgrade parser, leading to ASGI scope header spoofing.
Which software is affected by CVE-2026-44546?
The vulnerability affects daphne versions prior to 4.2.2.
When was CVE-2026-44546 published?
CVE-2026-44546 was published on June 3, 2026.