Debian Patches

Status for python-daphne/4.1.2-2+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
twisted-24.7.0.patch fix tests with Twisted 24.7.0
In the fixed test cases the responses now contain `HTTP/1.1` rather than
`HTTP/1.0`.		 Robert Schütz <mail@dotlambda.de> no other, https://github.com/django/daphne/pull/526 2024-08-18
0001-Fixed-CVE-2026-44546-Prevent-header-injection-on-Web.patch Fixed CVE-2026-44546: Prevent header injection on WebSocket upgrade path

Fixed a header injection vulnerability on the WebSocket upgrade path
(CVE-2026-44546).

Header values containing ``\x0b``, ``\x0c``, ``\x1c``, ``\x1d``, ``\x1e``, or
``\x85`` were parsed as a single header by Twisted but split into multiple
headers by autobahn during the WebSocket handshake. An attacker could exploit
this parser differential to smuggle additional headers (e.g. authentication
tokens, ``X-Forwarded-For``, ``Origin``, ``Daphne-Root-Path``) into the ASGI
scope passed to the application.

Daphne now rejects requests carrying these bytes in any header value with a 400
Bad Request response, as required by RFC 9110 §5.5.

Thanks to Rene Henningsen for the report.		 Carlton Gibson <carlton.gibson@noumenal.es> no 2026-05-06
0002-Fixed-CVE-2026-44545-Limit-WebSocket-sizes-in-autoba.patch Fixed CVE-2026-44545: Limit WebSocket sizes in autobahn config.
Fixed a denial of service vulnerability via unbounded WebSocket message sizes.
Daphne previously passed no message or frame size limits to autobahn, whose
defaults are unbounded. This allowed an unauthenticated client to exhaust
server memory by sending a very large WebSocket messages/frames
(CVE-2026-44545).

Both limits now default to 1 MiB and can be configured via the new
``--websocket-max-message-size`` and ``--websocket-max-frame-size`` CLI flags
(or the matching ``Server`` constructor arguments). Pass ``0`` to restore the
previous unlimited behaviour.

Thanks to ParkHyunWoo for the report.		 Carlton Gibson <carlton.gibson@noumenal.es> no 2026-05-06

All known versions for source package 'python-daphne'

Links