CVE-2026-115877

The record

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

Affected packages

Related vulnerabilities

• CVE-2026-55613 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55614 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55612 uhttpd is a small HTTP server. CWE-444
• CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests… CWE-444
• CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which is used… CWE-444
• CVE-2026-118264 Echo is a Go web framework. CWE-444
• CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorrectly… CWE-444
• CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests… CWE-444