Twisted vulnerable to HTTP Request Smuggling Attacks

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

not scored

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security) 2. " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security) 3. ~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ closed in 9646 4.…

Published by the source

7 Oct 2022, 07:31 UTC

Last modified by the source

30 Nov 2024, 05:35 UTC

Source last checked

26 Oct 2026, 13:08 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-8r99-h8j2-rw64

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-8r99-h8j2-rw64

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-8r99-h8j2-rw64

Advisory: Twisted vulnerable to HTTP Request Smuggling Attacks
IDs: GHSA-8r99-h8j2-rw64
Record: https://patchnext.com/advisories/ghsa-8r99-h8j2-rw64 (revision 2, source checked 26 Oct 2026, 13:08 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Unrated
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: twisted 20.3.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI twisted: affected < 20.3.0; fixed in 20.3.0

## Suggested inspection (read-only)
- `python -m pip show twisted`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on twisted.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-8r99-h8j2-rw64 (OSV record GHSA-8r99-h8j2-rw64 lists affected ranges: PyPI twisted >=0 <20.3.0 (fixed))
- Verified: https://github.com/advisories/GHSA-8r99-h8j2-rw64 (GitHub-reviewed advisory GHSA-8r99-h8j2-rw64 lists affected ranges: PyPI twisted >=0 <20.3.0)

Commands are suggestions: review each one before running it.