---
id: CVE-2026-115877
title: >-
  twisted: Twisted: HTTP request smuggling via improper header delimiter
  handling (CVE-2026-115877)
summary: >-
  A flaw was found in Twisted. The HTTP server component improperly accepts bare
  carriage return or line feed characters within header values instead of
  enforcing strict line endings. A remote attacker can exploit this framing
  disagreement a…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-444
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - ansible_automation_platform 2
  - openstack_platform 16.2
patched:
  - twisted 26.10.0rc1
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T21:05:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115877'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2560182'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115877'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115877'
  - url: >-
      https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a
  - url: >-
      https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1
  - url: 'https://github.com/twisted/twisted/pull/12755'
  - url: 'https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1'
  - url: 'https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4'
  - url: 'https://github.com/twisted/twisted'
  - url: 'https://github.com/advisories/GHSA-q7qq-6mhp-9rc4'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
  - cve.org
aliases:
  - GHSA-q7qq-6mhp-9rc4
ecosystem: pip
ingestedAt: '2026-10-23T21:38:13.044Z'
epss: 0.00257
epssPercentile: 0.17223
---

## Overview

A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling. This flaw can allow attackers to bypass front-end access controls, poison shared connections or web caches, and expose sensitive responses meant for other clients.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115877.json)

**twisted: Twisted: HTTP request smuggling via improper header delimiter handling** — rated Moderate by Red Hat. Released 2026-10-23.

Affected:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenStack Platform 16.2

No fix planned:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenStack Platform 16.2

## Remediation

Out of support scope

## Package advisory (CVE-2026-115877)

Affected packages:

- `twisted < 26.10.0rc1`

Patched in:

- `twisted 26.10.0rc1`

Source: https://osv.dev/vulnerability/GHSA-q7qq-6mhp-9rc4