Skip to content
OpenAdvisories

Package · Debian

python-daphne

2 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Feed

  • Low 3.7
    CVE-2026-44546

    Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

    daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header …

    djangoproject daphne python-daphne python-daphne Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2026-44545

    Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

    daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or f…

    djangoproject daphne daphne py3-daphne Debian Ubuntu Alpine PyPI