Inconsistent interpretation of HTTP requests in Twisted Web - CVE-2026-115877
Published: November 5, 2026
Vulnerability details
The vulnerability allows HTTP request smuggling in Twisted Web when it is deployed behind a front-end proxy that accepts a bare carriage return (CR) or line feed (LF) as a header-line terminator. An attacker can bypass front-end access controls, poison a shared connection so that a later victim receives the response to an attacker-chosen request, and poison a cache. The vulnerability does not permit code execution.
The vulnerability exists due to incomplete header-value validation in twisted.web.http.HTTPChannel.headerReceived, which rejects NUL bytes but accepts bare CR and LF characters. A remote attacker can send a request through a front-end with the differing line-termination behavior, embedding a bare CR or LF followed by a Content-Length header inside another header's value and placing a second request after the header block. Twisted splits header lines only on CRLF, so it treats the embedded header as part of the preceding value, never recognizes its body length, and frames the first request with an empty body. The front-end instead recognizes the embedded header and treats the following bytes as the first request's body, while Twisted parses those bytes as a separate request. Both the bare CR and bare LF variants produce this disagreement.
In twisted/web/http.py, the header parser splits each header line at the first colon and strips spaces and tabs from the value, leaving embedded CR and LF characters intact. Because _maybeChooseTransferDecoder receives only the outer header name, it does not install a body decoder for the concealed Content-Length header. Header names and request lines already reject CR and LF; the validation gap is confined to header values, contrary to RFC 9110 section 5.5. For example, bytes intended by the front-end as the body of a request to /public can become a separate request to /admin in Twisted, generating an extra response that can desynchronize a shared connection. The request-smuggling exposure requires the front-end parsing discrepancy.