{"id":"AZL-111407","summary":"CVE-2026-115877 affecting package python-twisted 22.10.0-6","details":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.","modified":"2026-10-30T05:35:37Z","published":"2026-10-23T21:17:23Z","upstream":["CVE-2026-115877"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115877"}],"affected":[{"package":{"name":"python-twisted","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-twisted"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.10.0-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111407.json"}}],"schema_version":"1.9.2"}