Vulnerability-Lookup

CVE-2026-115877 (GCVE-0-2026-115877)

Vulnerability from cvelistv5 – Published: 2026-10-23 20:25 – Updated: 2026-10-23 20:25

Title

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/twisted/twisted/security/advis…	x_refsource_CONFIRM
https://github.com/twisted/twisted/pull/12755	x_refsource_MISC
https://github.com/twisted/twisted/commit/022b6f7…	x_refsource_MISC
https://github.com/twisted/twisted/commit/1616f70…	x_refsource_MISC
https://github.com/twisted/twisted/releases/tag/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
twisted	twisted	Affected: < 26.10.0rc1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "twisted",
          "vendor": "twisted",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.10.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T20:25:12.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4"
        },
        {
          "name": "https://github.com/twisted/twisted/pull/12755",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/pull/12755"
        },
        {
          "name": "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"
        },
        {
          "name": "https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1"
        },
        {
          "name": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-q7qq-6mhp-9rc4",
        "discovery": "UNKNOWN"
      },
      "title": "Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115877",
    "datePublished": "2026-10-23T20:25:12.031Z",
    "dateReserved": "2026-10-23T19:37:27.176Z",
    "dateUpdated": "2026-10-23T20:25:12.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-115877",
      "date": "2026-10-25",
      "epss": "0.00257",
      "percentile": "0.17142"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "twisted",
                "vendor": "twisted",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 26.10.0rc1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1."
          }
        ],
        "id": "CVE-2026-115877",
        "lastModified": "2026-10-23T21:17:23.643",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T21:17:23.643",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/pull/12755"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-444"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-23T21:05:37+00:00",
      "cve": "CVE-2026-115877",
      "id": "CVE-2026-115877",
      "initial_release_date": "2026-10-23T20:25:12.031000+00:00",
      "product_status:known_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "twisted: Twisted: HTTP request smuggling via improper header delimiter handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-115877

Vulnerability from fkie_nvd - Published: 2026-10-23 21:17 - Updated: 2026-10-23 21:17

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a
	security-advisories@github.com	https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1
	security-advisories@github.com	https://github.com/twisted/twisted/pull/12755
	security-advisories@github.com	https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
	security-advisories@github.com	https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "twisted",
          "vendor": "twisted",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.10.0rc1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1."
    }
  ],
  "id": "CVE-2026-115877",
  "lastModified": "2026-10-23T21:17:23.643",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-23T21:17:23.643",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/pull/12755"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-Q7QQ-6MHP-9RC4

Vulnerability from github – Published: 2026-10-23 20:44 – Updated: 2026-10-23 20:44

Summary

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Details

Summary

An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.

Details

headerReceived splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:

# twisted/web/http.py  HTTPChannel.headerReceived
data = data.strip(b" \t")
if b"\x00" in data:          # NUL rejected; a bare CR or LF is not
    self._respondToBadRequestAndDisconnect()
    return False

The channel delimiter is CRLF, so Foo: x\nContent-Length: 39 is one line: the split yields name Foo and value x\nContent-Length: 39, strip leaves the LF, and the NUL check passes. _maybeChooseTransferDecoder is then called with Foo, never sees a Content-Length, and installs no body decoder, so the request is framed with an empty body. The header name and request line already reject CR and LF, so the value is the only gap.

Affected product: Twisted, twisted.web.http.HTTPChannel Affected versions: 26.4.0 and earlier

PoC

Feed one connection a request whose header value carries a bare LF and a Content-Length, followed by a second request in the bytes after it: POST /public HTTP/1.1\r\nHost: v\r\nFoo: x\nContent-Length: 44\r\n\r\nGET /admin HTTP/1.1\r\nHost: internal\r\n\r\n. Twisted parses two requests and serves both, so the smuggled GET /admin returns the /admin response body even though the visible request was only POST /public. The bare CR variant behaves identically, and a NUL in the value is rejected, which isolates the missing CR and LF checks.

Behind a front-end that treats the bare LF as a line terminator, the front-end frames one POST /public and forwards a body while Twisted frames a second GET /admin; the extra response then poisons the shared connection, so a later victim receives the attacker's GET /admin response.

Impact

This is an HTTP request-smuggling exposure (CWE-444) from inconsistent interpretation of a request (CWE-436). Through a front-end that accepts a bare CR or LF as a line terminator, an attacker can smuggle a request the front-end never sees, bypassing front-end access controls, poisoning a shared connection so a later victim receives the attacker's response, and poisoning a cache. Twisted is the strict endpoint that frames the request without a body, so it is realized only behind such a proxy, and there is no code execution.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 26.4.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Twisted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.10.0rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T20:44:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAn incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. `twisted.web.http.HTTPChannel.headerReceived` rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is folded into the value and the request is framed with no body. A front-end that treats the bare LF as a line terminator frames the request differently, and the disagreement lets an attacker smuggle a request past it. This is an incomplete fix of the earlier Twisted request-smuggling advisories, which guarded the NUL sibling of this exact check.\n\n## Details\n\n`headerReceived` splits a header line on the first colon, strips space and tab from the value, and validates it with a single test that rejects only NUL:\n\n```python\n# twisted/web/http.py  HTTPChannel.headerReceived\ndata = data.strip(b\" \\t\")\nif b\"\\x00\" in data:          # NUL rejected; a bare CR or LF is not\n    self._respondToBadRequestAndDisconnect()\n    return False\n```\n\nThe channel delimiter is CRLF, so `Foo: x\\nContent-Length: 39` is one line: the split yields name `Foo` and value `x\\nContent-Length: 39`, `strip` leaves the LF, and the NUL check passes. `_maybeChooseTransferDecoder` is then called with `Foo`, never sees a `Content-Length`, and installs no body decoder, so the request is framed with an empty body. The header name and request line already reject CR and LF, so the value is the only gap.\n\nAffected product: Twisted, `twisted.web.http.HTTPChannel`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nFeed one connection a request whose header value carries a bare LF and a `Content-Length`, followed by a second request in the bytes after it: `POST /public HTTP/1.1\\r\\nHost: v\\r\\nFoo: x\\nContent-Length: 44\\r\\n\\r\\nGET /admin HTTP/1.1\\r\\nHost: internal\\r\\n\\r\\n`. Twisted parses two requests and serves both, so the smuggled `GET /admin` returns the /admin response body even though the visible request was only `POST /public`. The bare CR variant behaves identically, and a NUL in the value is rejected, which isolates the missing CR and LF checks.\n\nBehind a front-end that treats the bare LF as a line terminator, the front-end frames one `POST /public` and forwards a body while Twisted frames a second `GET /admin`; the extra response then poisons the shared connection, so a later victim receives the attacker\u0027s `GET /admin` response.\n\n## Impact\n\nThis is an HTTP request-smuggling exposure (CWE-444) from inconsistent interpretation of a request (CWE-436). Through a front-end that accepts a bare CR or LF as a line terminator, an attacker can smuggle a request the front-end never sees, bypassing front-end access controls, poisoning a shared connection so a later victim receives the attacker\u0027s response, and poisoning a cache. Twisted is the strict endpoint that frames the request without a body, so it is realized only behind such a proxy, and there is no code execution.",
  "id": "GHSA-q7qq-6mhp-9rc4",
  "modified": "2026-10-23T20:44:43Z",
  "published": "2026-10-23T20:44:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/pull/12755"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twisted/twisted"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-115877 (GCVE-0-2026-115877)

FKIE_CVE-2026-115877

GHSA-Q7QQ-6MHP-9RC4

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour