A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling. This flaw can allow attackers to bypass front-end access controls, poison shared connections or web caches, and expose sensitive responses meant for other clients.