Request Smuggling Vulnerability in Twisted Framework Affecting HTTP Handling

CVE-2026-115877

What is CVE-2026-115877?

The Twisted framework is susceptible to a request smuggling vulnerability due to inadequate handling of HTTP headers. Specifically, the 'headerReceived' method in the 'twisted.web.http.HTTPChannel' allows bare carriage return (CR) or line feed (LF) characters, which can lead to potential exploitation. Attackers can use this weakness to bypass front-end access controls and potentially expose subsequent clients to incorrect responses. This vulnerability arises from incomplete fixes related to Twisted's earlier protections against request smuggling. The issue has been addressed in version 26.10.0rc1, which is essential for users to upgrade to mitigate risks.

References