Medium severity · published Oct 25, 2023
CVE-2023-46137
Twisted is an event-based framework for internet applications
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twisted · Twisted
through 22.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46137
Exploit
https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
More from Twisted
9.8
CVE-2020-10109
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
9.8
CVE-2020-10108
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
8.7
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
8.1
CVE-2022-24801
Twisted is an event-based framework for internet applications, supporting Python 3.6+
7.5
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer