CVE-2026-115877: 
Python vulnerability analysis and mitigation

CVE-2026-115877 is an HTTP Request Smuggling vulnerability (CWE-444) in the Twisted Python web framework, specifically in twisted.web.http.HTTPChannel.headerReceived. The flaw allows a bare carriage return (CR) or line feed (LF) character in an HTTP header value to hide a following header from Twisted's parser, enabling request smuggling when Twisted is deployed behind a lenient front-end proxy. All versions of Twisted up to and including 26.4.0 are affected; the issue is fixed in version 26.10.0rc1. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory). The advisory was published on October 23, 2026, and is classified as an incomplete fix residual of earlier Twisted request-smuggling protections (GitHub Advisory).

The root cause is incomplete input validation in twisted.web.http.HTTPChannel.headerReceived (CWE-444). The function correctly rejects NUL bytes (\x00) in header values but fails to reject bare CR (\r) or LF (\n) characters, contrary to RFC 9110 section 5.5, which mandates rejection of all three. Because Twisted splits header lines only on CRLF sequences, a crafted header value such as Foo: x\nContent-Length: 44 arrives as a single line — the bare LF folds the Content-Length header into the Foo value, so Twisted never sees a body length and frames the request with an empty body. A front-end proxy that treats the bare LF as a legitimate line terminator parses the request differently, creating a framing disagreement that allows a smuggled request to bypass the proxy (GitHub Advisory, Fix Commit). The fix, merged in PR #12755, extends the existing NUL check to also reject CR and LF using a single-pass translate call: if len(data.translate(None, b"\x00\r\n")) != len(data) (Fix Commit).

Successful exploitation enables an unauthenticated network attacker to smuggle HTTP requests past front-end proxies and access controls, potentially reaching internal or restricted endpoints (e.g., /admin) that the proxy would otherwise block. The attack can also poison shared connections so that a subsequent victim client receives the attacker's response, and can poison shared caches to serve malicious content to other users. There is no code execution risk — Twisted acts as the strict back-end endpoint — but confidentiality and integrity are both impacted at a low level through unauthorized data access and response manipulation (GitHub Advisory).

As of the advisory publication date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific deployment topology — Twisted must be behind a front-end proxy that accepts bare CR or LF as line terminators — which raises the effective attack complexity (rated High in CVSS).

1. Identify target topology: Confirm that the target application runs Twisted (version ≤ 26.4.0) behind a front-end proxy (e.g., nginx, HAProxy, or a CDN) that treats a bare LF as a valid HTTP line terminator.
2. Craft a smuggling request: Construct an HTTP request where a header value contains a bare LF followed by a hidden Content-Length header and a smuggled request body. Example raw bytes sent over a single TCP connection:

POST /public HTTP/1.1\r\nHost: target.example\r\nFoo: x\nContent-Length: 44\r\n\r\nGET /admin HTTP/1.1\r\nHost: internal\r\n\r\n

3. Send the request: Deliver the crafted bytes directly over a persistent TCP connection to the front-end proxy, ensuring the bare LF is not normalized to CRLF in transit.
4. Observe framing disagreement: The front-end proxy parses Foo: x and Content-Length: 44 as two separate headers, forwarding a body of 44 bytes (the smuggled GET /admin request). Twisted sees only Foo: x\nContent-Length: 44 as a single header value, frames the POST with no body, and then processes the remaining bytes as a second independent request — GET /admin.
5. Achieve objective: Twisted serves the GET /admin response, bypassing the proxy's access control. In a shared-connection scenario, the extra response poisons the connection so the next client receives the attacker's GET /admin response (GitHub Advisory).

• Network: HTTP requests to the Twisted backend containing bare LF (0x0A) or bare CR (0x0D) characters within header values (not preceded/followed by the complementary CR/LF); unexpected follow-on requests to restricted paths (e.g., /admin, /internal) arriving on the same TCP connection as a public-path request.
• Logs: Twisted access logs showing two distinct requests logged from a single connection where only one was expected; requests to privileged endpoints with no corresponding front-end proxy log entry; HTTP 400 responses from Twisted after patching (indicating attempted exploitation of the now-rejected pattern).
• Application Behavior: Clients reporting receiving unexpected or mismatched HTTP responses (cache poisoning symptom); users receiving responses intended for other sessions on shared connections.

Upgrade Twisted to version 26.10.0rc1 or later, which rejects bare CR and LF characters in HTTP header values with a 400 Bad Request response (Twisted Release). As a defense-in-depth workaround, configure front-end proxies to strictly validate HTTP header values and reject requests containing bare CR or LF characters before forwarding to the backend, eliminating the framing disagreement that enables smuggling. Additionally, ensure front-end proxies are configured to normalize or reject non-CRLF line terminators in HTTP headers per RFC 9110 section 5.5 (GitHub Advisory).

The fix was contributed by community researcher arkmarta via pull request #12755, reviewed and approved by Twisted maintainers gudnimg and twm, and merged on August 2, 2026 (Fix PR). The Twisted maintainer twm noted during review that even stricter validation of all CTL characters (beyond CR, LF, and NUL) could be considered in the future, citing RFC 9110's broader guidance (Fix PR). Red Hat has tracked the issue via Bugzilla (bug #2560182), indicating downstream Linux distribution awareness (Red Hat Bugzilla).