daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's
    WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote
    attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption
    and a denial of service. (CVE-2026-44545)

  - daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn
    for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header
    line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit
    this parser differential to inject additional headers into the ASGI scope passed to the application.
    daphne now rejects requests with these bytes in any header value with a 400 response. (CVE-2026-44546)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn
    for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header
    line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit
    this parser differential to inject additional headers into the ASGI scope passed to the application.
    daphne now rejects requests with these bytes in any header value with a 400 response. (CVE-2026-44546)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn     for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header     line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit     this parser differential to inject additional headers into the ASGI scope passed to the application.
    daphne now rejects requests with these bytes in any header value with a 400 response. (CVE-2026-44546)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
445845	Alpine: multiple py3-daphne packages: security update to 4.2.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
445845	Alpine: multiple py3-daphne packages: security update to 4.2.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
444653	SCA: security update for daphne (GHSA-xh68-hfp5-5x5m)	Tenable Cloud Security	SCA Checks	medium
444653	SCA: security update for daphne (GHSA-xh68-hfp5-5x5m)	Tenable Self-Hosted Container Security	SCA Checks	medium
318549	Linux Distros Unpatched Vulnerability : CVE-2026-44546	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44546

medium

Tenable Plugins

medium

medium

medium

medium

medium