Daphne before version 4.2.2 reconstructs raw HTTP requests from Twisted's parsed headers and passes them to autobahn for WebSocket handshake processing. Twisted does not recognize certain control characters (\x0b, \x0c, \x1c, \x1d, \x1e, \x85) as header line separators, whereas autobahn decodes header values to strings and splits lines, causing a parser discrepancy. This inconsistency allows an attacker to inject additional headers into the ASGI scope, effectively enabling HTTP request smuggling (CWE-444). The vulnerability affects daphne version 4.2.0. The vendor fixed this by rejecting requests with these control characters in header values with a 400 response in versions after 4.2.0.

An attacker can exploit the inconsistent interpretation of HTTP headers to inject additional headers into the ASGI scope, potentially manipulating how the application processes requests. The CVSS score of 3.7 (low severity) reflects limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild.

A fix is available in daphne versions after 4.2.0 that rejects requests containing the problematic control characters in header values with a 400 response. Users should upgrade to daphne 4.2.2 or later to mitigate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the description indicates the fix is present in versions after 4.2.0. Check the official djangoproject advisories for the exact fixed version and update accordingly.