PT-2026-45941 · Autobahn+2 · Autobahn+2

Carlton Gibson + 1 · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-44546

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions daphne versions prior to 4.2.2

Description A parser differential exists when reconstructing raw HTTP requests from Twisted's parsed headers for WebSocket handshake processing in autobahn. While Twisted does not recognize the bytes x0b, x0c, x1c, x1d, x1e, or x85 as header line separators, autobahn decodes these values to strings and utilizes the splitlines() function. This discrepancy allows an attacker to inject additional headers into the ASGI scope passed to the application.

Recommendations Update to version 4.2.2 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-44546

Affected Products

Twisted

Autobahn

Daphne

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-44546 · Security Note
• https://github.com/django/daphne/blob/main/CHANGELOG.txt · Note
• https://t.me/CVEtracker/55720 · Telegram Post