Read the docs
TI-2026-79989 Aliases CVE-2026-115877GHSA-q7qq-6mhp-9rc4

HTTP request smuggling in Twisted web via bare CR or LF in headers

Priority MEDIUM 58CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Twisted versions before 26.10.0rc1 accept a bare carriage return or bare line feed in HTTP header values in twisted.web. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can stay folded into another value while a lenient front end treats the bare character as a line terminator (CWE-444). A remote unauthenticated attacker can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. The issue is an incomplete fix of earlier Twisted request smuggling protections.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Partial twisted (twisted): 26.10.0rc1Twisted (PyPI): 26.10.0rc1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
twistedtwistedbefore 26.10.0rc126.10.0rc1Patch availableCNA
—Twisted (PyPI)before 26.10.0rc126.10.0rc1Patch availableGHSA-q7qq-6mhp-9rc4
  • twisted Vendortwisted Affected before 26.10.0rc1 Fixed in 26.10.0rc1 Patch available CNA
  • Twisted (PyPI) Vendor— Affected before 26.10.0rc1 Fixed in 26.10.0rc1 Patch available GHSA-q7qq-6mhp-9rc4

Remediation

Upgrade Twisted to version 26.10.0rc1, the fixed version listed for the PyPI package. Red Hat Ansible Automation Platform 2 has no fix available, and Red Hat OpenStack Platform 16.2 has no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA twisted (twisted) Fixed in 26.10.0rc1
  • Fix · GHSA-q7qq-6mhp-9rc4 Twisted (PyPI) Fixed in 26.10.0rc1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115877
  2. 2026-10-23 Alias added: GHSA-q7qq-6mhp-9rc4
  3. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-q7qq-6mhp-9rc4
  4. 2026-10-23 CVSS score added · GHSA-q7qq-6mhp-9rc4
  5. 2026-10-23 Weakness changed · GHSA-q7qq-6mhp-9rc4
  6. 2026-10-23 6 new references · GHSA-q7qq-6mhp-9rc4
  7. 2026-10-24 Priority changed: MEDIUM → LOW
  8. 2026-10-24 Affected versions changed · Red Hat
  9. 2026-10-24 CVSS score added · Red Hat
  10. 2026-10-29 CISA SSVC decision points changed
  11. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 6

  • TI-2026-79985 Unauthenticated memory exhaustion in Twisted domish XML parser CVSS 4.0HIGH 8.7
  • TI-2026-30612 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains CVSS 3.1HIGH 7.5
  • TI-2022-06090 Buffer Overflow in Twisted CVSS 3.1HIGH 7.5
  • TI-2024-27732 twisted.web has disordered HTTP pipeline response CVSS 3.1HIGH 8.3
  • TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
  • TI-2022-18723 Twisted vulnerable to NameVirtualHost Host header injection CVSS 3.1MEDIUM 5.4
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences