DEBIAN-CVE-2026-44546

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-44546
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-44546
Upstream
Published
2026-06-03T14:16:43Z
Modified
2026-09-14T17:03:35Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

References

Affected packages

Debian:12 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.0.0-1
4.1.2-1
4.1.2-2
4.2.1-1
4.2.1-2
4.2.2-0.1
4.2.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"

Debian:13 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.1.2-2+deb13u1

Affected versions

4.*
4.1.2-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"

Debian:14 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.2.2-0.1

Affected versions

4.*
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"