Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-23T20:25:12 twisted: Twisted: HTTP request smuggling via improper header delimiter handling 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CWE-444

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling. This flaw can allow attackers to bypass front-end access controls, poison shared connections or web caches, and expose sensitive responses meant for other clients.

This vulnerability is rated as Moderate impact because successful exploitation requires an upstream reverse proxy configuration that interprets bare line delimiters differently than the backend Twisted HTTP server. In supported Red Hat environments hosting Twisted services behind proxy intermediaries, an attacker could exploit framing discrepancies to smuggle requests, potentially bypassing proxy access controls or poisoning shared connections. However, the overall severity is bounded because the flaw does not facilitate arbitrary code execution or underlying host compromise. Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred automation-controller Red Hat Ansible Automation Platform 2 Fix deferred python3.11-twisted Red Hat Ansible Automation Platform 2 Fix deferred python3.12-twisted Red Hat Ansible Automation Platform 2 Out of support scope python3x-twisted Red Hat Ansible Automation Platform 2 Out of support scope python-twisted Red Hat OpenStack Platform 16.2 Out of support scope python-twisted https://www.cve.org/CVERecord?id=CVE-2026-115877 https://nvd.nist.gov/vuln/detail/CVE-2026-115877 https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1 https://github.com/twisted/twisted/pull/12755 https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1 https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4