PT-2023-8632 · Twisted+5 · Twisted+5
Mukeran
·
Published
2023-10-25
·
Updated
2025-09-05
·
CVE-2023-46137
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Twisted versions prior to 23.10.0rc1
Description
The issue is related to the inconsistent interpretation of HTTP requests in the twisted.web component of the Twisted framework. When sending multiple HTTP requests in one TCP packet, twisted.web processes the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launches two requests using HTTP pipeline.
Recommendations
For Twisted versions prior to 23.10.0rc1, update to version 23.10.0rc1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of HTTP pipeline for sensitive requests until the issue is resolved. Restrict access to endpoints that can be controlled by an attacker to minimize the risk of exploitation.
Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Red Os
Suse
Twisted
Ubuntu