CVE-2026-115877

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1

Description An incomplete header-value validation in the Twisted HTTP server allows a bare carriage return (CR) or line feed (LF) in a header value to hide a subsequent header from the parser. The function twisted.web.http.HTTPChannel.headerReceived rejects NUL bytes but fails to reject bare CR or LF characters. Since the framework splits header lines only on CRLF, a header containing a bare LF can cause a second header, such as Content-Length, to be folded into the value of the first. This creates a framing disagreement between Twisted and a lenient front-end proxy that treats the bare character as a line terminator. An attacker can exploit this to smuggle requests past front-end access controls, poison shared connections or caches, and cause subsequent clients to receive incorrect responses.

Recommendations Update Twisted to version 26.10.0rc1 or later.