{"id":"CVE-2026-115877","title":"twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)","summary":"A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement a…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-444","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["ansible_automation_platform 2","openstack_platform 16.2"],"patched":["twisted 26.10.0rc1"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:05:37+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115877"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560182"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115877"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115877"},{"url":"https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"},{"url":"https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1"},{"url":"https://github.com/twisted/twisted/pull/12755"},{"url":"https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4"},{"url":"https://github.com/twisted/twisted"},{"url":"https://github.com/advisories/GHSA-q7qq-6mhp-9rc4"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa","cve.org"],"aliases":["GHSA-q7qq-6mhp-9rc4"],"ecosystem":"pip","ingestedAt":"2026-10-23T21:38:13.044Z","epss":0.00257,"epssPercentile":0.17223,"slug":"CVE-2026-115877","body":"## Overview\n\nA flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling. This flaw can allow attackers to bypass front-end access controls, poison shared connections or web caches, and expose sensitive responses meant for other clients.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json)\n\n**twisted: Twisted: HTTP request smuggling via improper header delimiter handling** — rated Moderate by Red Hat. Released 2026-10-23.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenStack Platform 16.2\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenStack Platform 16.2\n\n## Remediation\n\nOut of support scope\n\n## Package advisory (CVE-2026-115877)\n\nAffected packages:\n\n- `twisted < 26.10.0rc1`\n\nPatched in:\n\n- `twisted 26.10.0rc1`\n\nSource: https://osv.dev/vulnerability/GHSA-q7qq-6mhp-9rc4","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}