Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with `END_STREAM` and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487.

Details For one received segment the h2 events are processed in order in `H2Connection.dataReceived`. A `HEADERS(END_STREAM)` followed by `RST_STREAM` yields `RequestReceived`, `StreamEnded`, then `StreamReset`, so the request is dispatched and rendered on stream end before the reset is handled: ```python

src/twisted/web/_http2.py (H2Connection.dataReceived) for event in events: if isinstance(event,…

Published by the source

29 Oct 2026, 16:41 UTC

Last modified by the source

29 Oct 2026, 17:00 UTC

Source last checked

30 Oct 2026, 06:25 UTC

1. Revision 2 · amended · 30 Oct 2026

   Amended from osv record GHSA-vpp8-g58w-m8mp

2. Revision 1 · created · 29 Oct 2026

   Published from ghsa record GHSA-vpp8-g58w-m8mp

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-vpp8-g58w-m8mp

Advisory: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
IDs: GHSA-vpp8-g58w-m8mp
Record: https://patchnext.com/advisories/ghsa-vpp8-g58w-m8mp (revision 2, source checked 30 Oct 2026, 06:25 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: twisted 26.10.0rc1. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI twisted: affected < 26.10.0rc1; fixed in 26.10.0rc1

## Suggested inspection (read-only)
- `python -m pip show twisted`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on twisted.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vpp8-g58w-m8mp (GitHub-reviewed advisory GHSA-vpp8-g58w-m8mp lists affected ranges: PyPI twisted >=0 <=26.4.0)
- Verified: https://osv.dev/vulnerability/GHSA-vpp8-g58w-m8mp (OSV record GHSA-vpp8-g58w-m8mp lists affected ranges: PyPI twisted >=0 <26.10.0rc1 (fixed))

Commands are suggestions: review each one before running it.