An error in Django's ASGIRequest class creates an ambiguity between headers containing hyphens and those containing underscores, returning the same underscore‑formatted header. This allows a remote attacker to cause header spoofing, potentially confusing application logic that relies on the header values. The vulnerability can be exploited by sending HTTP requests that include both hyphen‑ and underscore‑style header names, leading to unintended behavior within the Django application.

Affected Django releases are 6.0 prior to 6.0.4, 5.2 prior to 5.2.13, and 4.2 prior to 4.2.30. Earlier unsupported series such as 5.0.x, 4.1.x and 3.2.x may also be impacted, but they are not actively maintained by the Django team.

The vulnerability carries a CVSS score of 7.5, an EPSS score of less than 1 %, and it is not listed in the CISA KEV catalog. It is inferred that a remote attacker would send crafted HTTP requests to the ASGI endpoint to exploit the header name conflation. Although the description does not explicitly mention authentication, the flaw appears to be exploitable without prior authentication. The high severity reflects potential logic or authorization bypass, but the low exploitation probability suggests a moderate overall risk for present deployments.