Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-115877 · GHSA-q7qq-6mhp-9rc4

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Risk score
42/100
CVSS
5.4 v3.1
Exploit chance (30 days)
0.3%
Published
23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Len…
Affected
Twisted (pip) <= 26.4.0
Fix
Upgrade Twisted to 26.10.0rc1 or later.
Exploitation
No known exploitation

Story map

Story map: TwistedTHE FLAWSTHE FIXCVE-2026-115877HTTP Request Smuggling intwisted.web via a Bare CR orLF in a Header ValueCVSS 5.4 · EPSS 0%CVE-2026-115775Unauthenticated Remote Denialof Service in the Twistedwords domish XML Element…CVSS 8.7 · EPSS 1%CVE-2026-115776Unauthenticated Remote Denialof Service in the Twisted IRCServer via an Unbounded Line…CVSS 7.5 · EPSS 1%CVE-2026-115778Unauthenticated Remote Denialof Service in the Twisted conchTelnet Transport via an…CVSS 7.5 · EPSS 1%Upgrade Twisted26.10.0or later on your release lineWho is exposed{'products': ['Twisted'],'packages': ['Twisted'],'versions': ['<= 26.4.0']}AMBER · PATCH THIS WEEKTwistedTwisted has a vulnerability in itsXML parser that allows anunauthenticated remote peer tocause a denial of service bycontinuously adding childelements to an in-memory tree,exhausting server memory and…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-444 (CWE-444)28 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Twisted: Amber, patch this week. Twisted has a vulnerability in its XML parser that allows an unauthenticated remote peer to cause a denial of service by continuously adding child elements to an in-memory tree, exhausting server memory and terminating the process.

The flaws

  • CVE-2026-115877: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (CVSS 5.4 · EPSS 0%)
  • CVE-2026-115775: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (CVSS 8.7 · EPSS 1%)
  • CVE-2026-115776: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (CVSS 7.5 · EPSS 1%)
  • CVE-2026-115778: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Twisted: 26.10.0 or later on your release line

Who is exposed: {'products': ['Twisted'], 'packages': ['Twisted'], 'versions': ['<= 26.4.0']}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.4 medium
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
Twistedpip<= 26.4.026.10.0rc1

References

Original description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

Last activity 23 Oct 2026. Patch Forecast updates every hour.