Twisted EUVD-2026-109153

Exploitation is realized ONLY when Twisted (twisted.web.http.HTTPChannel, versions <= 26.4.0) is deployed behind a front-end proxy/load balancer that accepts a bare carriage return or bare line feed as an HTTP header-line terminator; the framing disagreement between that lenient front-end and Twisted's strict CRLF-only splitting is the core prerequisite. No authentication is required (PR:N) and no user interaction is needed (UI:N), and it works against default Twisted configurations. The key LIMITING factor is the proxy dependency: Twisted is the strict endpoint that frames the smuggled request with an empty body, so if Twisted terminates connections directly, or the front-end also rejects bare CR/LF per RFC 9110 section 5.5, the smuggling cannot occur. There is no code execution in any configuration.

This is a genuine but conditional, medium-severity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N = 5.4) is internally coherent with the mechanism: network reachable and unauthenticated (PR:N), but AC:H because exploitation is not self-contained - it depends on a front-end proxy that treats a bare CR or LF as a line terminator while Twisted does not, a precondition outside the attacker's control. The scope change (S:C) and C:L/I:L reflect that the real damage lands on other parties (front-end access controls, shared connection, cache, and a later victim client), not on the Twisted process itself, and there is no availability impact and no code execution. The input does not provide an EPSS score, and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. A concrete PoC (exact smuggling byte sequence) is published in the GHSA advisory, but the input does not mark it as confirmed working packaged exploit code. The vuln.today Decision label is 'this_month', which aligns with a real-but-not-urgent remediation posture: patch within normal cycles, prioritized where Twisted sits behind a lenient reverse proxy. No signals conflict here; the main caveat is that risk is entirely contingent on the front-end's parsing behavior, so environments terminating Twisted directly or behind a strict RFC 9110 proxy face substantially lower practical risk.

An unauthenticated attacker sends a single crafted HTTP request to a Twisted-backed service sitting behind a reverse proxy, embedding a bare LF plus a hidden Content-Length inside a header value (e.g. 'Foo: x\nContent-Length: 44'). The lenient front-end frames one request and forwards access-controlled traffic, while Twisted frames a second smuggled request (e.g. GET /admin) and serves it, poisoning the shared connection or cache so a later victim receives the attacker-induced response. A public PoC reference with the exact request bytes exists in the GHSA advisory; it is not verified as packaged working exploit code, and AC:H reflects the required cooperating front-end.