DEBIAN-CVE-2026-44546

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-44546
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-44546
Upstream
Published
2026-06-03T14:16:43.720Z
Modified
2026-06-15T19:06:29.266775904Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

References

Affected packages

Debian:11 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=bullseye

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.1-1
3.0.2-1
4.*
4.0.0-1
4.1.2-1
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"

Debian:12 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.0.0-1
4.1.2-1
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"

Debian:13 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"

Debian:14 / python-daphne

Package

Name
python-daphne
Purl
pkg:deb/debian/python-daphne?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.1.2-2
4.2.1-1
4.2.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44546.json"