CVE-2026-42304 | High | 7.5 | 2026-05-13 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial o… |
CVE-2024-41810 | Medium | 6.1 | 2024-07-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vu… |
CVE-2024-41671 | High | 8.3 | 2024-07-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipeli… |
CVE-2023-46137 | Medium | 5.3 | 2023-10-25 | Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web… |
CVE-2022-39348 | Medium | 5.4 | 2022-10-26 | Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.v… |
CVE-2022-24801 | High | 8.1 | 2022-04-04 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-21712 | High | 7.5 | 2022-02-07 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-ori… |
CVE-2022-23607 | Medium | 6.5 | 2022-02-01 | treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HT… |
CVE-2020-10109 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the cont… |
CVE-2020-10108 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header… |
CVE-2016-1000111 | Medium | 5.3 | 2020-03-11 | Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence… |
CVE-2014-7143 | High | 7.5 | 2019-11-12 | Python Twisted 14.0 trustRoot is not respected in HTTP client |
CVE-2019-12855 | High | 7.4 | 2019-06-16 | In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connec… |
CVE-2019-12387 | Medium | 6.1 | 2019-06-10 | In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |