Technical impact
Twisted’s HTTPChannel rejects NUL bytes but accepts bare carriage returns or line feeds in header values. Because header lines are split only on CRLF, an attacker can insert a bare CR or LF to cause a lenient front‑end to treat the character as a line terminator. This creates a hidden header line folded into another header while the following request is injected, producing a framing mismatch that smuggles a request past front‑end access controls, poisons a shared connection or cache, and exposes later clients to unintended responses.
Affected Systems
Twisted framework (twisted:twisted) versions prior to 26.10.0rc1 are affected. The vulnerability is fixed in version 26.10.0rc1 and all subsequent releases.
Risk and Exploitability
The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA KEV. Exploitation requires a crafted HTTP request that passes through a front‑end that accepts bare CR or LF characters, making the likely attack vector network‑based. An attacker could inject requests that bypass access controls or corrupt a cache, potentially leading to unauthorized request execution or information disclosure to later clients.
Github GHSA