◆ CVE Hub

CVE-2026-115877

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Published
2026-10-23
Last modified
2026-10-23
CNA
GitHub_M
NVD status
Received
CWE
CWE-444

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
5.4
MEDIUM
Scored by github.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
5.4
MEDIUM
Scored by CNA (GitHub_M) · v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS exploit probability
0.3%
Percentile 24.5%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interactionConditions Scope change Confidentiality LIntegrity LAvailability N

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACHHigh (conditions required)
Privileges required PRNNone
User interaction UINNone
Scope SCChanged (affects other components)
Confidentiality CLLow
Integrity ILLow
Availability ANNone
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

NVD

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)3.15.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA / GitHub_M3.15.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
twistedtwisted
affected: < 26.10.0rc1

Open-source packages (GitHub Advisory / OSV)

GHSA-q7qq-6mhp-9rc4 GHSA MEDIUM reviewed

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

EcosystemPackageAffected versionsFixed in
PyPITwisted<= 26.4.026.10.0rc1

Linux distribution status

Red Hat ↗ moderate

ReleasePackageStatusFixed version / notes
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/controller-rhel8out of support scope
Red Hat Ansible Automation Platform 2ansible-automation-platform-25/controller-rhel8out of support scope
Red Hat Ansible Automation Platform 2ansible-automation-platform-25/lightspeed-rhel8out of support scope
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/controller-rhel9fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/eda-controller-rhel9fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/lightspeed-rhel9fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/controller-rhel9fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/eda-controller-rhel9fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/lightspeed-rhel9fix deferred
Red Hat Ansible Automation Platform 2automation-controllerfix deferred
Red Hat Ansible Automation Platform 2python-twistedout of support scope
Red Hat OpenStack Platform 16.2python-twistedout of support scope
Red Hat Ansible Automation Platform 2python3.11-twistedfix deferred
Red Hat Ansible Automation Platform 2python3.12-twistedfix deferred
Red Hat Ansible Automation Platform 2python3x-twistedout of support scope

Debian ↗

ReleasePackageStatusFixed version / notes
bookwormtwistedopen not yet assigned
forkytwistedopen not yet assigned
sidtwistedopen not yet assigned
trixietwistedopen not yet assigned no-dsa: Minor issue

Ubuntu ↗ Fetching

References (6)