{"id":"CVE-2023-46137","aliases":["AZL-31788","AZL-35140","CLSA-2025-1762474360","DEBIAN-CVE-2023-46137","DLA-3970-1","DSA-5797-1","EUVD-2023-0250","GHSA-xc8x-vp79-p3wm","MGASA-2025-0054","OESA-2024-1011","OESA-2024-1012","OESA-2024-1013","OESA-2024-1014","OESA-2024-1015","OESA-2024-1047","PYSEC-2023-224","RHSA-2024:0322","RHSA-2024:1516","RHSA-2024:1518","RHSA-2024:1640","SUSE-SU-2023:4490-1","SUSE-SU-2023:4607-1","SUSE-SU-2023:4608-1","SUSE-SU-2023:4830-1","UBUNTU-CVE-2023-46137","USN-6575-1","openSUSE-SU-2024:13430-1"],"status":"published","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00879,"percentile":0.59384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2023-10-25T20:56:27Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["23.10.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.10.0-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-twisted","fixed_in":["22.10.0-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["22.4.0-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["23.10.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["23.10.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-twisted","fixed_in":["22.4.0-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","fixed_in":["22.4.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-twisted","fixed_in":["22.4.0-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-twisted","fixed_in":["22.4.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-twisted","fixed_in":["22.4.0-3.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-twisted","fixed_in":["22.4.0-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted-debugsource","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted-debuginfo","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted-debugsource","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted-debuginfo","fixed_in":["0:16.4.1-21.el8ost"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","fixed_in":["19.10.0-150200.3.21.1","22.10.0-150400.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"python3-Twisted","fixed_in":["22.2.0-150400.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"python3-Twisted","fixed_in":["22.2.0-150400.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python3-Twisted","fixed_in":["22.2.0-150400.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python3-Twisted","fixed_in":["22.2.0-150400.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP4","package":"python-Twisted","fixed_in":["22.10.0-150400.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Twisted","fixed_in":["22.10.0-150400.5.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-Twisted","fixed_in":["22.10.0-150400.5.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"python-Twisted","fixed_in":["17.9.0-150000.3.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"twisted","fixed_in":["18.9.0-11ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twisted","fixed_in":["22.1.0-2ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"twisted","fixed_in":["22.4.0-4ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","fixed_in":["22.10.0-9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.10.0rc1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.3.0"},{"fixed":"20.3.0.post4+tuxcare"}]}],"versions":["20.3.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.10.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-7+deb11u2"}]}],"versions":["20.3.0-7","20.3.0-7+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.10.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.8.0","23.8.0rc1","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-2.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-3.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.10.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","22.8.0","22.10.0rc1","22.10.0","23.8.0rc1","23.8.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.40-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-twisted+tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-twisted+tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.10.0-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-21.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.5-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.11-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-150000.3.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2","13.2.0-1ubuntu1.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1","16.0.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3","17.9.0-2ubuntu0.3+esm1","17.9.0-2ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.3"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.4"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4ubuntu1"}]}],"versions":["22.4.0-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.3"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.4"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-9.1"}]}]}],"products":[{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46137","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2023-224.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc8x-vp79-p3wm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46137.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46137","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0054.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33807","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6575-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-2","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1011","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1012","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1013","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1014","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1015","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1047","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0322","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247040","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0322.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41040","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46137","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1516","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1516.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1518","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1518.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1640","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1640.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39326","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45857","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49083","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1394","tags":["advisory"]},{"url":"https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136","tags":["article"]},{"url":"https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6","tags":["article"]},{"url":"https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2660","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2024-2660.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.3","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24680","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxj9-f6rv-m3x4","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/feb/06/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234490-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216588","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234607-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234608-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234830-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39348","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46137","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T20:56:27.32Z","modified":"2025-11-03T21:49:56.068Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:35:23.645864Z"}],"euvd":[{"id":"EUVD-2023-0250","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T20:56:27Z","modified":"2025-11-03T21:49:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-xc8x-vp79-p3wm","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.\n\n### Details\nThere's an example faulty program:\n```python\nfrom twisted.internet import reactor, endpoints\nfrom twisted.web import server\nfrom twisted.web.proxy import ReverseProxyResource\nfrom twisted.web.resource import Resource\n\nclass Second(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        return b'SECOND\\n'\n\nclass First(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        def send_response():\n            request.write(b'FIRST DELAYED\\n')\n            request.finish()\n        reactor.callLater(0.5, send_response)\n        return server.NOT_DONE_YET\n\nroot = Resource()\n\nroot.putChild(b'second', Second())\nroot.putChild(b'first', First())\n\nendpoint = endpoints.TCP4ServerEndpoint(reactor, 8080)\nendpoint.listen(server.Site(root))\nreactor.run()\n```\n\nWhen two requests for `/first` and `/second` are sent in the same order, the second request will be responded to first.\n```shell\necho -en \"GET /first HTTP/1.1\\r\\nHost: a\\r\\n\\r\\nGET /second HTTP/1.1\\r\\nHost: a\\r\\n\\r\\n\" | nc localhost 8080\n```","status":"published","published":"2023-10-25T21:15:13Z","modified":"2025-11-04T16:46:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-46137","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:10.237Z","modified":"2026-06-17T06:30:13.843Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"AZL-31788","title":"CVE-2023-46137 affecting package python-twisted for versions less than 22.10.0-4","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:10Z","modified":"2026-04-21T04:26:31.658568Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-35140","title":"CVE-2023-46137 affecting package python-twisted for versions less than 22.10.0-4","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:10Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"CVE-2023-46137","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T20:56:27.32Z","modified":"2026-10-28T02:30:45.512655703Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46137","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:10.237Z","modified":"2026-10-26T18:01:55.263819306Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-xc8x-vp79-p3wm","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.\n\n### Details\nThere's an example faulty program:\n```python\nfrom twisted.internet import reactor, endpoints\nfrom twisted.web import server\nfrom twisted.web.proxy import ReverseProxyResource\nfrom twisted.web.resource import Resource\n\nclass Second(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        return b'SECOND\\n'\n\nclass First(Resource):\n    isLeaf = True\n    def render_GET(self, request):\n        def send_response():\n            request.write(b'FIRST DELAYED\\n')\n            request.finish()\n        reactor.callLater(0.5, send_response)\n        return server.NOT_DONE_YET\n\nroot = Resource()\n\nroot.putChild(b'second', Second())\nroot.putChild(b'first', First())\n\nendpoint = endpoints.TCP4ServerEndpoint(reactor, 8080)\nendpoint.listen(server.Site(root))\nreactor.run()\n```\n\nWhen two requests for `/first` and `/second` are sent in the same order, the second request will be responded to first.\n```shell\necho -en \"GET /first HTTP/1.1\\r\\nHost: a\\r\\n\\r\\nGET /second HTTP/1.1\\r\\nHost: a\\r\\n\\r\\n\" | nc localhost 8080\n```","status":"published","published":"2023-10-25T21:15:13Z","modified":"2025-11-04T17:02:09.832366Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"OESA-2024-1011","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:12.231527415Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1012","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:12.194201486Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1013","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:11.422894979Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1014","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:11.397515079Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1015","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-05T11:06:27Z","modified":"2026-08-18T01:18:12.200558484Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1047","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.(CVE-2023-46137)","status":"published","published":"2024-01-12T11:06:29Z","modified":"2026-08-18T01:18:12.533537522Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"PYSEC-2023-224","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:00Z","modified":"2023-11-08T04:13:41.189622Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"RHSA-2024:0322","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-16T15:58:35Z","modified":"2026-08-07T10:11:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1516","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-twisted) security update","status":"published","published":"2024-09-16T15:44:46Z","modified":"2026-06-03T10:06:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1518","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.6 (python-twisted) security update","status":"published","published":"2024-09-16T15:44:55Z","modified":"2026-06-03T10:06:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1640","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-09-30T15:52:23Z","modified":"2026-10-18T10:02:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2023-46137","description":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.","status":"published","published":"2023-10-25T21:15:00Z","modified":"2026-02-04T04:37:02.840313Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2025-1762474360","title":"TuxCare security update for twisted (4 CVEs)","description":"TuxCare rebuilt twisted to address 4 CVEs. Fixed in 20.3.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.955124071Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3970-1","title":"twisted - security update","status":"published","published":"2024-11-28T00:00:00Z","modified":"2026-03-09T01:22:40.257832Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5797-1","title":"twisted - security update","status":"published","published":"2024-10-25T00:00:00Z","modified":"2026-03-09T02:08:52.022156Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0054","title":"Updated python-twisted packages fix security vulnerabilities","description":"Twisted.web has disordered HTTP pipeline response. (CVE-2023-46137)\nTwisted.web has disordered HTTP pipeline response. (CVE-2024-41671)\nHTML injection in HTTP redirect body. (CVE-2024-41810)\n","status":"published","published":"2025-02-12T06:37:33Z","modified":"2026-04-16T04:43:07.105273148Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:13430-1","title":"python-Twisted-doc-22.10.0-9.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-22.10.0-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:17:30.347722Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4490-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588)\n","status":"published","published":"2023-11-20T13:26:13Z","modified":"2026-02-04T04:24:31.404236Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4607-1","title":"Security update for python3-Twisted","description":"This update for python3-Twisted fixes the following issues:\n\n- CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588)\n","status":"published","published":"2023-11-29T08:59:28Z","modified":"2026-02-04T04:14:33.390468Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4608-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588)\n","status":"published","published":"2023-11-29T08:59:54Z","modified":"2026-02-04T03:29:06.587582Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4830-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588)\n","status":"published","published":"2023-12-14T10:05:53Z","modified":"2026-02-04T03:49:31.15344Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6575-1","title":"twisted vulnerabilities","description":"It was discovered that Twisted incorrectly escaped host headers in certain\n404 responses. A remote attacker could possibly use this issue to perform\nHTML and script injection attacks. This issue only affected Ubuntu 20.04\nLTS and Ubuntu 22.04 LTS. (CVE-2022-39348)\n\nIt was discovered that Twisted incorrectly handled response order when\nprocessing multiple HTTP requests. A remote attacker could possibly use\nthis issue to delay responses and manipulate the responses of second\nrequests. (CVE-2023-46137)\n","status":"published","published":"2024-01-10T13:39:55Z","modified":"2026-04-27T17:01:57.037443Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}