daphne CVE-2026-44546

Exploitation requires daphne before 4.2.2 to be the ASGI server AND the application must expose at least one WebSocket endpoint, as the vulnerability lies in the WebSocket upgrade handshake path through autobahn - pure HTTP-only daphne deployments are not affected by this injection vector. The attack is unauthenticated per CVSS PR:N, but requires high complexity (AC:H): the attacker must know which of the six specific Unicode bytes (\x0b, \x0c, \x1c, \x1d, \x1e, \x85) to embed in a header value and must identify a header name whose injection will be acted upon by the application. Security impact is further bounded by whether the target application makes trust decisions (authentication, authorization, routing, rate-limiting) based on headers in the ASGI scope - applications that sanitize or ignore client-supplied headers beyond standard WebSocket fields are not meaningfully exploitable even if the injection succeeds technically. Non-default configuration is not required; any default daphne deployment with WebSocket support is within scope.

The CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N reflects meaningful real-world constraints. Network reachability (AV:N) and no authentication requirement (PR:N) lower the barrier to attempt, but high attack complexity (AC:H) acknowledges that successful exploitation demands precise knowledge of the parser differential and careful crafting of header values containing the specific Unicode bytes. The rated impact - low confidentiality, no integrity or availability - represents the baseline case where injected headers expose information. However, the CVE tags of 'Code Injection' and 'Request Smuggling' suggest that actual application-layer impact varies significantly: applications that make security-relevant decisions from ASGI-scope headers (e.g., X-Forwarded-For for IP allow-listing, X-Role or X-Auth-Token for authorization) are at materially higher risk than the base CVSS score implies. EPSS data was not provided in the intelligence feed, so exploitation probability is unknown. There is no CISA KEV listing and no public POC has been identified, confirming no confirmed active exploitation at time of analysis. The discrepancy between the low base score and the 'Code Injection' tag warrants application-level triage: teams should assess whether their Django application logic consumes or trusts client-supplied headers from the ASGI scope before deprioritizing this patch.

An unauthenticated attacker sends an HTTP WebSocket upgrade request to a daphne-backed endpoint with a crafted header such as 'X-Legit-Header: value\x85X-Injected: attacker-value'. Twisted passes 'value\x85X-Injected: attacker-value' as a single header value, but autobahn's str.splitlines() splits it on \x85, causing 'X-Injected: attacker-value' to appear as a distinct header in the ASGI scope. If the Django application grants elevated access or bypasses rate-limiting based on a header like X-Forwarded-For or a custom role header, the attacker gains unauthorized access or bypasses a security control. No public POC code has been identified at time of analysis.