GHSA-32gv-6cf3-wcmq

HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods

No scoreFix available

Impact

Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:

Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512 Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515

A Twisted web server supports HTTP/2 requests if you've installed the http2 optional dependency set.

Workarounds

There are no workarounds.

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

For more information

If you have any questions or comments about this advisory:

Open an issue in Twisted's Trac

What each source reports

GitHub AdvisoriesNo score

HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods

Impact

Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:

A Twisted web server supports HTTP/2 requests if you've installed the http2 optional dependency set.

Workarounds

There are no workarounds.

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

For more information

If you have any questions or comments about this advisory:

Open an issue in Twisted's Trac

Record: GHSA-32gv-6cf3-wcmq
Updated: 2026-11-02

OSVNo score

HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods

Impact

Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:

A Twisted web server supports HTTP/2 requests if you've installed the http2 optional dependency set.

Workarounds

There are no workarounds.

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

For more information

If you have any questions or comments about this advisory:

Open an issue in Twisted's Trac

Record: GHSA-32gv-6cf3-wcmq
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`twisted` PyPI	before 19.10.0	19.10.0
`twisted` PyPI	before 19.10.0, plus listed versions 1.0.11.0.31.0.41.0.51.0.6 Show 45 moreShow less 1.0.71.1.01.1.11.2.010.0.010.1.010.2.011.0.011.1.012.0.012.1.012.2.012.3.013.0.013.1.013.2.014.0.014.0.114.0.215.0.015.1.015.2.015.2.115.3.015.4.015.5.016.0.016.1.016.1.116.2.016.3.016.3.116.3.216.4.016.4.116.5.016.5.0rc116.5.0rc216.6.016.6.0rc116.7.0rc116.7.0rc217.1.017.1.0rc117.5.0	19.10.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-32gv-6cf3-wcmq is a vulnerability with no CVSS score yet in twisted, published March 14, 2022. No source lists public exploit code. Fixed in twisted 19.10.0.

References

This page doesn't list everything

Left out here: 24 versions. The JSON record has them.