CVE-2019-12387: Injection in Twisted
Summary
CVE-2019-12387: Twisted CRLF Injection. Affects twisted versions < 19.2.1. Fixed in 19.2.1. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2019-12387 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is a popular Python framework for asynchronous network programming. It provides a variety of modules and utilities for building network applications. However, prior to version 19.2.1, Twisted's twisted.web module did not properly validate or sanitize URIs or HTTP methods, leaving it vulnerable to injection attacks. An attacker could exploit this vulnerability by injecting invalid characters, such as CRLF, into the URI or HTTP method.
Vulnerability Detail
The injection vulnerability in Twisted's twisted.web module allows an attacker to manipulate the URI or HTTP method, potentially leading to various security issues. By injecting CRLF characters, an attacker could perform HTTP response splitting attacks, HTTP request smuggling attacks, or other forms of injection-based attacks. These attacks could result in unauthorized access, data leakage, or the execution of arbitrary code.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.2.1
This is the first release that contains the fix.
pip install --upgrade "twisted==19.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Twisted is not immediately feasible, a temporary workaround is to implement input validation and sanitization on the server-side. This can be done by carefully validating and filtering user-supplied input for URIs and HTTP methods, ensuring that no malicious or unexpected characters are allowed. Additionally, implementing a Web Application Firewall (WAF) can provide an extra layer of protection against injection attacks.
Conclusion
In conclusion, the injection vulnerability in Twisted's twisted.web module can be mitigated by upgrading to version 19.2.1 or later. It is crucial to promptly apply security patches and updates to protect against potential injection attacks. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
The vulnerability allows an attacker to inject invalid characters into URIs or HTTP methods, potentially leading to various security issues such as unauthorized access, data leakage, or the execution of arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is always recommended to promptly apply security patches and updates to mitigate any potential risks.
You can find more information about this vulnerability, including the official advisory and fix, on the GitHub Security Advisory Database at https://github.com/github/advisory-database/advisories/GHSA-6cc5-2vg4-cc7m.
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
