{"action":"Upgrade twisted to 26.10.0rc1 or later.","affected":[{"fixed":"26.10.0rc1","introduced":"0"}],"component":"twisted","cve_ids":["CVE-2026-115877"],"ecosystem":"PyPI","epss":0.00257,"exploited":false,"fixed_versions":["26.10.0rc1"],"ghsa_id":"GHSA-q7qq-6mhp-9rc4","id":"tcs_01M5NASWWPHE5WNXSR835QWKKQ","modified_at":"2026-10-23T21:00:05.299702082Z","published_at":"2026-10-23T20:44:43Z","references":["https://osv.dev/vulnerability/GHSA-q7qq-6mhp-9rc4","https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4","https://github.com/twisted/twisted/pull/12755","https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a","https://github.com/twisted/twisted/commit/1616f702d36eda8990a5a5b22ad70fab140a7eb1","https://github.com/twisted/twisted","https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-q7qq-6mhp-9rc4","url":"https://osv.dev/vulnerability/GHSA-q7qq-6mhp-9rc4"}],"summary":"Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value"}