HTTP/2 DoS Attacks in Twisted
Summary
GHSA-32gv-6cf3-wcmq: HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods. Affects twisted versions < 19.10.0. Fixed in 19.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including web servers. Twisted web servers that utilize the optional HTTP/2 support are vulnerable to DoS attacks, specifically Ping, Reset, and Settings floods. These vulnerabilities can be exploited by malicious actors to disrupt the normal functioning of the server.
Vulnerability Detail
The HTTP/2 DoS vulnerabilities in Twisted web servers are flow-control related. The Ping flood vulnerability (CVE-2019-9512) allows an attacker to send a large number of Ping frames, overwhelming the server's resources. The Reset flood vulnerability (CVE-2019-9514) enables an attacker to flood the server with RST_STREAM frames, causing it to terminate connections. The Settings flood vulnerability (CVE-2019-9515) allows an attacker to send a large number of SETTINGS frames, potentially causing the server to consume excessive resources. These vulnerabilities affect Twisted web servers that have the optional HTTP/2 support installed.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.10.0
This is the first release that contains the fix.
pip install --upgrade "twisted==19.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to update the Twisted package to the fixed version to mitigate the risk.
Conclusion
Twisted web servers that utilize the optional HTTP/2 support are vulnerable to DoS attacks, including Ping, Reset, and Settings floods. To protect your server, it is crucial to update the Twisted package to version 19.10.0 or later. This update includes patches that address the flow-control vulnerabilities in the HTTP/2 implementation. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including web servers.
HTTP/2 is a major revision of the HTTP network protocol. It introduces several performance improvements and new features compared to the previous version, HTTP/1.1.
A Ping flood is a type of DoS attack where an attacker sends a large number of Ping frames to overwhelm the server's resources and disrupt its normal functioning.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for open-source vulnerabilities, including the HTTP/2 DoS vulnerabilities in Twisted.
Yes, updating the Twisted package to version 19.10.0 or later will fix these vulnerabilities. It is recommended to apply the update as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
