Vulnerability in Djangoproject Daphne
CVE-2026-44546
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (19.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Djangoproject Daphne — versions 4.2.0, 4.2.2
Weakness classification (CWE)
References
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92 (release-notes, Release Notes)
Frequently asked questions
- What is CVE-2026-44546?
- CVE-2026-44546 is a low-severity vulnerability in Djangoproject Daphne, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 3.7/10. Published 2026-06-03.
- How severe is CVE-2026-44546?
- Low severity. CVSS v3 base score is 3.7 out of 10.