... .4.17 release. WSGI header spoofing via underscore/dash conflation ¶ When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, conv ... erting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... proxy carefully strips any incoming value for X-Auth-User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing und ... ... rithm for generating file names if a file with the uploaded name already exists. Storage.get_available_name now appends an underscore plus a random 7 character alphanumeric string (e.g. "_x3a1gho" ), rather than iterating through an underscore followed by ... nge generate certain reversing scheme relative slashes example site ensures huge number stat uploaded files requests issue underscore RemoteUserMiddleware session クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... rithm for generating file names if a file with the uploaded name already exists. Storage.get_available_name now appends an underscore plus a random 7 character alphanumeric string (e.g. "_x3a1gho" ), rather than iterating through an underscore followed by ... nge generate certain reversing scheme relative slashes example site ensures huge number stat uploaded files requests issue underscore RemoteUserMiddleware session クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... .4.17 release. WSGI header spoofing via underscore/dash conflation ¶ When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, conv ... erting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... proxy carefully strips any incoming value for X-Auth-User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing und ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... proxy carefully strips any incoming value for X-Auth-User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing und ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus al ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive w ... proxy carefully strips any incoming value for X-Auth-User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing und ... ... low" in 4.2.29. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a r ... fully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the ... ... low" in 5.2.12. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a r ... fully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the ... 2026年10月08日