HTTP Request Smuggling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR \r and LF \n characters in HTTP...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

CVE-2026-115877 Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF...

CVE-2026-115877

The Twisted event-based framework (Python 3.6+) is vulnerable to HTTP Request Smuggling prior to version 26.10.0rc1 . The root cause is located in twisted.web.http.HTTPChannel.headerReceived, which rejects NUL bytes but incorrectly accepts bare carriage returns (CR) or line feeds (LF) in header v...

Twisted input validation error vulnerability

Versions of Twisted prior to 26.10.0rc1 contain an input validation error vulnerability. This vulnerability stems from the fact that twisted.web.http.HTTPChannel.headerReceived accepts raw carriage returns or line feeds in HTTP header values and splits header lines only on CRLF. This may lead to...