Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-03T13:17:55 daphne: daphne: Information disclosure via header injection due to parser differential 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-444

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

A flaw was found in daphne. This vulnerability arises from a parser differential where daphne reconstructs HTTP requests from Twisted's headers, but Twisted and autobahn handle certain header line separators differently. An attacker can exploit this to inject additional headers into the ASGI (Asynchronous Server Gateway Interface) scope, potentially leading to information disclosure.

Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred automation-controller https://www.cve.org/CVERecord?id=CVE-2026-44546 https://nvd.nist.gov/vuln/detail/CVE-2026-44546 https://github.com/django/daphne/blob/main/CHANGELOG.txt