Daphne versions prior to 4.2.2 reconstruct raw HTTP requests from Twisted's parsed headers and pass them to autobahn for WebSocket handshake processing. Twisted does not recognize certain control characters (\x0b, \x0c, \x1c, \x1d, \x1e, \x85) as header line separators, while autobahn decodes header values to strings and splits lines, treating these characters as separators. This mismatch allows an attacker to exploit the parser differential to inject additional headers into the ASGI scope, potentially affecting application behavior. Daphne 4.2.2 mitigates this by rejecting requests with these bytes in any header value, returning a 400 error.

The vulnerability allows injection of additional headers into the ASGI scope due to inconsistent parsing of HTTP headers, which may lead to unexpected application behavior. The CVSS score of 3.7 indicates low severity with limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild.

A fix is available in daphne version 4.2.2, which rejects requests containing the problematic control characters in header values with a 400 response. Users should upgrade to daphne 4.2.2 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the description states the issue is fixed in 4.2.2. No additional mitigations are indicated.