{"id":"ghsa-ghsa-q7qq-6mhp-9rc4","seq":661344,"kind":"advisory","title":"Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value","url":"https://github.com/advisories/GHSA-q7qq-6mhp-9rc4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q7qq-6mhp-9rc4","summary":"影響: pip:Twisted <= 26.4.0 → 26.10.0rc1\nAn incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is f…","severity":"medium","techs":["python"],"cves":["CVE-2026-115877"],"tags":["GHSA-q7qq-6mhp-9rc4","Twisted"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:44:43.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}