diff --git a/gunicorn/asgi/parser.py b/gunicorn/asgi/parser.py
index 9e3f70f2..2fc4a3d1 100644
--- a/gunicorn/asgi/parser.py
+++ b/gunicorn/asgi/parser.py
@@ -804,8 +804,11 @@ class PythonProtocol:
         return True
 
     def _has_invalid_header_chars(self, value):
-        """Check for NUL, CR, LF in header value."""
-        return b'\x00' in value or b'\r' in value or b'\n' in value
+        """RFC 9110 section 5.5: only VCHAR, SP, HTAB, and obs-text allowed."""
+        for c in value:
+            if c <= 0x08 or 0x0a <= c <= 0x1f or c == 0x7f:
+                return True
+        return False
 
 
 class CallbackRequest:
diff --git a/gunicorn/http/message.py b/gunicorn/http/message.py
index b27f40a5..1cc94fb7 100644
--- a/gunicorn/http/message.py
+++ b/gunicorn/http/message.py
@@ -130,7 +130,10 @@ TOKEN_RE = re.compile(r"[%s0-9a-zA-Z]+" % (re.escape(RFC9110_5_6_2_TOKEN_SPECIAL
 METHOD_BADCHAR_RE = re.compile("[a-z#]")
 # usually 1.0 or 1.1 - RFC9112 permits restricting to single-digit versions
 VERSION_RE = re.compile(r"HTTP/(\d)\.(\d)")
-RFC9110_5_5_INVALID_AND_DANGEROUS = re.compile(r"[\0\r\n]")
+# RFC 9110 section 5.5: field-vchar = VCHAR / obs-text; SP and HTAB are the
+# only non-VCHAR bytes allowed in a field-value. Anything else in the
+# control range (0x00-0x1F except HTAB, plus DEL 0x7F) must be rejected.
+RFC9110_5_5_INVALID_AND_DANGEROUS = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
 
 # RFC 9110 section 6.5.1: fields forbidden in trailers because they alter
 # routing, framing, or authentication. Using the uppercased names stored