cyfenced.com →

[ CVE-2026-115877 · Published 23 Oct 2026 ]

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

CVSS 5.4 EPSS <1%Fix available

[ Description ]Official description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

[ Fixes ]Fixes and patches

  • Twisted 26.10.0rc1Fixed version · GitHub Advisories · pip package Twisted: upgrade to 26.10.0rc1 or later (affected <= 26.4.0)

[ Packages ]Affected open-source packages

[ References ]References