Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
影響: pip:Twisted <= 26.4.0 → 26.10.0rc1
An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even though RFC 9110 section 5.5 requires a recipient to reject all three. Because the channel splits requests only on CRLF, a value carrying a bare LF and a second header arrives as one line, so the second header is f…
Read on GitHub Advisory Database
| CVE | CVE-2026-115877 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/24/2026, 01:50 PM |
| Data | Markdown JSON |
On 10/24/2026, 05:44 AM, GitHub Advisory Database published "Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-115877.