PT-2024-5828 · Twisted+5 · Twisted+5
Kenballus
·
Published
2024-07-29
·
Updated
2025-09-22
·
CVE-2024-41671
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Twisted versions prior to 24.7.0rc1
Description
The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This issue is related to the incorrect handling of HTTP requests. Exploitation of this issue may allow a remote attacker to disclose protected information. For instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.
Recommendations
As a temporary workaround, consider disabling the
twisted.web module until a patch is available.
For versions prior to 24.7.0rc1, update to version 24.7.0rc1 or later to resolve the issue.Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Red Os
Suse
Twisted
Ubuntu