{"id":"CVE-2020-10108","aliases":["ALPINE-CVE-2020-10108","AZL-6819","BELL-CVE-2020-10108","DEBIAN-CVE-2020-10108","DLA-2145-1","DLA-2927-1","EUVD-2020-0228","GHSA-h96w-mmrf-2h6v","MGASA-2020-0428","PYSEC-2020-259","RHSA-2020:1561","RHSA-2020:1962","SUSE-SU-2022:2811-1","SUSE-SU-2022:4074-1","UBUNTU-CVE-2020-10108","USN-4308-1","USN-4308-2","openSUSE-SU-2024:11041-1"],"status":"published","title":"Improper Input Validation in Twisted","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03973,"percentile":0.90551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-444"],"published":"2020-03-12T12:42:33Z","modified":"2026-11-03T06:32:30Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["20.3.0","20.3.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-twisted","fixed_in":["20.3.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["18.9.0-7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"python-twisted-web","fixed_in":["0:8.2.0-6.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"python-twisted-web","fixed_in":["0:8.2.0-6.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"python-twisted-web","fixed_in":["0:8.2.0-6.el6_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","fixed_in":["13.2.0-1ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"twisted","fixed_in":["16.0.0-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.2-3+deb8u1"}]}],"versions":["14.0.2-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.0-2+deb9u1"}]}],"versions":["16.6.0-2"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0rc1","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Mageia:7","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.2.1-1.2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.0-7.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.0-7.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.0-7.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.1.0-7.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.0-6.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.0-6.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"python-twisted-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.2.0-6.el6_10"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm1"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm1"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1.1"}]}],"bundled":11}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"solaris"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4308-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4308-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202007-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://know.bishopfox.com/advisories","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory"]},{"url":"https://know.bishopfox.com/advisories/twisted-version-19.10.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10108","tags":["web","advisory"]},{"url":"https://github.com/twisted/twisted/blob/6ff2c40e42416c83203422ff70dfc49d2681c8e2/NEWS.rst#twisted-2030-2020-03-13","tags":["web"]},{"url":"https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-259.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D","tags":["web"]},{"url":"https://usn.ubuntu.com/4308-1","tags":["web"]},{"url":"https://usn.ubuntu.com/4308-2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h96w-mmrf-2h6v","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-10108","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-10108","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10108","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0428.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26355","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4308-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1561","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2020/dla-2145","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813447","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1561.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10108","tags":["advisory","report"]},{"url":"https://github.com/twisted/twisted/blob/twisted-20.3.0/NEWS.rst","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10109","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1962","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1962.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222811-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1166457","tags":["report"]},{"url":"https://bugzilla.suse.com/1166458","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224074-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39348","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-10108","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4308-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10109","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39164","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T12:42:33Z","modified":"2024-08-04T10:50:57.819Z","updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-0228","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T12:42:33Z","modified":"2024-08-04T10:50:57Z","updated_at":"2026-11-03T03:07:51.994742Z"}],"ghsa":[{"id":"GHSA-h96w-mmrf-2h6v","title":"Improper Input Validation in Twisted","description":"In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-31T15:42:42Z","modified":"2024-11-25T18:33:22Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-444"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:12.293Z","modified":"2026-06-17T02:47:22.303Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:05:55.32877Z"}],"osv":[{"id":"ALPINE-CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:12.293Z","modified":"2026-11-03T06:32:30.038714233Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"AZL-6819","title":"CVE-2020-10108 affecting package python-twisted for versions less than 22.2.0-1","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:12Z","modified":"2026-04-21T04:38:21.312007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2020-10108","title":"CVE-2020-10108 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:28.771214Z","modified":"2026-01-26T09:50:08.606104Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:12.293Z","modified":"2026-10-24T10:30:27.88822247Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:12.293Z","modified":"2026-10-26T12:00:08.611110994Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-h96w-mmrf-2h6v","title":"Improper Input Validation in Twisted","description":"In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-31T15:42:42Z","modified":"2024-11-25T18:48:08.662171Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20","CWE-444"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RHSA-2020:1561","title":"Red Hat Security Advisory: python-twisted-web security update","status":"published","published":"2024-09-16T04:00:21Z","modified":"2026-06-27T10:09:51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:1962","title":"Red Hat Security Advisory: python-twisted-web security update","status":"published","published":"2024-09-16T04:00:28Z","modified":"2026-06-27T10:10:03Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-10108","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:00Z","modified":"2026-02-04T04:39:40.609635Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-2145-1","title":"twisted - security update","status":"published","published":"2020-03-17T00:00:00Z","modified":"2026-03-09T01:19:14.134209Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2927-1","title":"twisted - security update","status":"published","published":"2022-02-19T00:00:00Z","modified":"2026-03-09T01:21:21.652203Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2020-0428","title":"Updated python-twisted packages fix security vulnerabilities","description":"Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain\ncontent-length headers. A remote attacker could possibly use this issue to\nperform HTTP request splitting attacks (CVE-2020-10108, CVE-2020-10109).\n","status":"published","published":"2020-11-21T12:21:00Z","modified":"2026-04-16T04:42:35.735426785Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:11041-1","title":"matrix-synapse-1.43.0-1.1 on GA media","description":"These are all security issues fixed in the matrix-synapse-1.43.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:36.180382Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"PYSEC-2020-259","description":"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","status":"published","published":"2020-03-12T13:15:00Z","modified":"2023-11-08T04:01:57.311203Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2022:2811-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2020-10108: Fixed an HTTP request smuggling issue (bsc#1166457).\n- CVE-2020-10109: Fixed an HTTP request smuggling issue (bsc#1166458).\n","status":"published","published":"2022-08-16T07:26:31Z","modified":"2026-02-04T02:24:03.842317Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:4074-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-39348: Fixed NameVirtualHost Host header injection (bsc#1204781).\n","status":"published","published":"2022-11-18T12:54:53Z","modified":"2026-02-04T04:11:13.441398Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4308-1","title":"twisted vulnerabilities","description":"it was discovered that Twisted incorrectly validated or sanitized certain\nURIs or HTTP methods. A remote attacker could use this issue to inject\ninvalid characters and possibly perform header injection attacks.\n(CVE-2019-12387)\n\nIt was discovered that Twisted incorrectly verified XMPP TLS certificates.\nA remote attacker could possibly use this issue to perform a\nmachine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)\n\nIt was discovered that Twisted incorrectly handled HTTP/2 connections. A\nremote attacker could possibly use this issue to cause Twisted to hang or\nconsume resources, leading to a denial of service. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514,\nCVE-2019-9515)\n\nJake Miller and ZeddYu Lu discovered that Twisted incorrectly handled\ncertain content-length headers. A remote attacker could possibly use this\nissue to perform HTTP request splitting attacks. (CVE-2020-10108,\nCVE-2020-10109)\n","status":"published","published":"2020-03-19T17:18:55Z","modified":"2026-04-27T15:48:43.343050534Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4308-2","title":"twisted vulnerabilities","description":"USN-4308-1 fixed several vulnerabilities in Twisted. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n it was discovered that Twisted incorrectly validated or sanitized certain\n URIs or HTTP methods. A remote attacker could use this issue to inject\n invalid characters and possibly perform header injection attacks.\n (CVE-2019-12387)\n\n It was discovered that Twisted incorrectly verified XMPP TLS certificates.\n A remote attacker could possibly use this issue to perform a\n machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)\n\n Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled\n certain content-length headers. A remote attacker could possibly use this\n issue to perform HTTP request splitting attacks. (CVE-2020-10108,\n CVE-2020-10109)\n","status":"published","published":"2020-03-30T12:00:51Z","modified":"2026-02-10T04:41:48Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}