UBUNTU-CVE-2026-44546

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-44546
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-44546
Upstream
  • CVE-2026-44546
Published
2026-06-03T14:16:00Z
Modified
2026-06-17T11:01:31.418371253Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

References

Affected packages

Ubuntu:18.04:LTS
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.2-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.4.2-1",
            "binary_name": "daphne"
        },
        {
            "binary_version": "1.4.2-1",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"
Ubuntu:20.04:LTS
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.3.0-1
2.4.0-1
2.4.1-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.4.1-1",
            "binary_name": "daphne"
        },
        {
            "binary_version": "2.4.1-1",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"
Ubuntu:22.04:LTS
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.1-1
3.0.2-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.0.2-1",
            "binary_name": "daphne"
        },
        {
            "binary_version": "3.0.2-1",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"
Ubuntu:24.04:LTS
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.0.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.0.0-1",
            "binary_name": "daphne"
        },
        {
            "binary_version": "4.0.0-1",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"
Ubuntu:25.10
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.1.2-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.1.2-2",
            "binary_name": "daphne"
        },
        {
            "binary_version": "4.1.2-2",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"
Ubuntu:26.04:LTS
python-daphne

Package

Name
python-daphne
Purl
pkg:deb/ubuntu/python-daphne?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "4.2.1-2",
            "binary_name": "daphne"
        },
        {
            "binary_version": "4.2.1-2",
            "binary_name": "python3-daphne"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44546.json"