CVE-2026-115877Medium· 5.4▾ SunlitA flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling. This flaw can allow attackers to bypass front-end access controls, poison shared connections or web caches, and expose sensitive responses meant for other clients.
twisted: Twisted: HTTP request smuggling via improper header delimiter handling — rated Moderate by Red Hat. Released 2026-10-23.
Affected:
No fix planned:
Out of support scope
Affected packages:
twisted < 26.10.0rc1Patched in:
twisted 26.10.0rc1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-41481Medium· 6.5langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)
CVE-2026-33154High· 7.5dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)
CVE-2026-33230Medium· 6.1nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)
CVE-2026-42563High· 8.0dulwich: Dulwich: Arbitrary code execution via malicious Git file paths during merge (CVE-2026-42563)