PyPI/daphne CVE-2026-44546: medium 5.3, EPSS 0.17%

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \

Action: Upgrade daphne to 4.2.2 or later.

pip install daphne==4.2.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-214
• https://github.com/django/daphne/blob/main/CHANGELOG.txt
• https://github.com/advisories/GHSA-xh68-hfp5-5x5m

CVE-2026-44546 · published 2026-06-03T14:16:43.720Z · modified 2026-07-13T16:45:11.395803736Z · JSON