HTTP Request Smuggling Affecting twisted package, versions [,26.10.0rc1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-TWISTED-21692665
- published24 Oct 2026
- disclosed23 Oct 2026
- creditArkadiusz Marta
Introduced: 23 Oct 2026
NewCVE-2026-115877 (opens in a new tab)How to fix?
Upgrade Twisted to version 26.10.0rc1 or higher.
Overview
Twisted is an event-based network programming and multi-protocol integration framework.
Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR (\r) and LF (\n) characters in HTTP header values. An attacker can inject a header value containing a bare LF or CR to smuggle a second HTTP request through a lenient front-end proxy, causing Twisted to parse and serve a request that the proxy never intended to forward. This allows the attacker to reach restricted endpoints or poison a shared connection so a subsequent victim receives the attacker's response.
PoC
Feed one connection a request whose header value carries a bare LF and a `Content-Length`, followed by a second request in the bytes after it: `POST /public HTTP/1.1\r\nHost: v\r\nFoo: x\nContent-Length: 44\r\n\r\nGET /admin HTTP/1.1\r\nHost: internal\r\n\r\n`. Twisted parses two requests and serves both, so the smuggled `GET /admin` returns the /admin response body even though the visible request was only `POST /public`. The bare CR variant behaves identically, and a NUL in the value is rejected, which isolates the missing CR and LF checks.
Behind a front-end that treats the bare LF as a line terminator, the front-end frames one `POST /public` and forwards a body while Twisted frames a second `GET /admin`; the extra response then poisons the shared connection, so a later victim receives the attacker's `GET /admin` response.
Note: The PoC states no specific environment, runtime version, operating system, or non-default configuration.