Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115877— Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Quick assessment

Affected
twisted twisted
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Twisted 是一个面向互联网应用的事件驱动框架，支持 Python 3.6 及以上版本。在 26.10.0rc1 版本之前， 方法会拒绝 HTTP 标头值中包含的空字节（NUL），但却允许单独出现的回车符（CR）或换行符（LF）。由于 Twisted 仅在 CRLF（回车 + 换行）处拆分标头行，因此一个隐藏的 标头可能被折叠（folded）到另一个标头值中，而某些宽松的前端代理会将单独的 CR 或 LF 视为行终止符。由此产生的分帧不一致（framing disagreement）可能导致攻击者绕过前端访问控

CVSS 5.4 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115877

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Source: CVE Program / CVE List V5
Vulnerability Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
twisted twisted < 26.10.0rc1 -

II. Public POCs for CVE-2026-115877

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115877

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115877 (3)

Vendor Advisories for CVE-2026-115877 (1)

Vendor Pages for CVE-2026-115877 (1)

Same Patch Batch · twisted · 2026-10-23 · 6 CVEs total

CVE-2026-115775 8.7 HIGH Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element
CVE-2026-115776 7.5 HIGH Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbound
CVE-2026-115778 7.5 HIGH Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport vi
CVE-2026-115774 4.9 MEDIUM Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEAR
CVE-2026-83813 3.1 LOW Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

IV. Related Vulnerabilities

Same product: twisted
Same vendor: twisted
Same weakness: CWE-444

V. Comments for CVE-2026-115877

No comments yet

Leave a comment