Detections
Analytics
Alpine: multiple py3-daphne packages: security update to 4.2.3-r0
medium Tenable Self-Hosted Container Security Plugin ID 445845
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's
WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote
attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption
and a denial of service. (CVE-2026-44545)
- daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn
for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header
line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit
this parser differential to inject additional headers into the ASGI scope passed to the application.
daphne now rejects requests with these bytes in any header value with a 400 response. (CVE-2026-44546)
Solution
Update the py3-daphne library and its related packages to version 4.2.3-r0 or later.See Also
Plugin Details
Severity: Medium
ID: 445845
Version: Revision 1.1
Type: Local
Published: 8/10/2026
Updated: 8/10/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.75
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-44546
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 6/3/2026
Reference Information
CVE: CVE-2026-44545, CVE-2026-44546