Improper Header Processing Vulnerability in Daphne by Django

CVE-2026-44546

What is CVE-2026-44546?

The vulnerability in Daphne arises from its handling of raw HTTP requests. When dealing with Twisted's parsed headers, Daphne fails to recognize certain byte sequences as valid header line separators. This oversight allows an attacker to exploit the parser's behavior by injecting additional headers into the ASGI scope that is processed by the application. As a result, malicious requests that include specific byte sequences in the headers can bypass standard security measures. In response, version 4.2.2 of Daphne introduces validation that rejects any requests containing these problematic byte values, responding with a 400 status code.

References