CVE-2026-115877 is an HTTP request smuggling vulnerability in the Twisted HTTP server (twisted.web.http.HTTPChannel) affecting versions 26.4.0 and earlier. It arises from incomplete validation of header values, allowing bare carriage return (CR) or line feed (LF) characters to be included, which can cause a front-end proxy and Twisted to interpret request boundaries differently. This discrepancy enables an attacker to smuggle unauthorized requests past front-end controls, potentially bypassing access restrictions, poisoning shared connections, and caching responses improperly. The vulnerability does not allow code execution and requires a front-end proxy that treats bare CR or LF as line terminators. A proof-of-concept demonstrates how an attacker can smuggle a GET request hidden inside a POST request's headers. The CVSS score is 5.4 (medium severity).