CVE-2022-24801: Inconsistent Interpretation of HTTP Requests in Twisted

twisted Updated 02 Oct 2025

Summary

04/04/2022

Disclosed on

CVE-2022-24801

CVE

Yes i

Fix available

Critical

Severity

8.1

CVSS Score

CVE-2022-24801: Inconsistent Interpretation of HTTP Requests in twisted.web. Affects twisted versions < 22.4.0. Fixed in 22.4.0. How to fix ↓

Also tracked for

twisted · Debian:11

The same CVE-2022-24801 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including servers, clients, and protocols. The Twisted Web module within Twisted includes an HTTP 1.1 server that is responsible for handling HTTP requests. However, this server has a vulnerability that allows for inconsistent interpretation of HTTP requests, potentially leading to HTTP request smuggling.

Vulnerability Detail

The Twisted Web HTTP 1.1 server parses certain HTTP request constructs more leniently than permitted by the RFC 7230 standard. This non-conformant parsing can result in desynchronization if requests pass through multiple HTTP parsers, potentially enabling HTTP request smuggling. The specific vulnerabilities include:

The Content-Length header value can have a + or - prefix.
Illegal characters are permitted in chunked extensions, such as the LF (\n) character.
Chunk lengths, expressed in hexadecimal format, can have a prefix of 0x.
HTTP headers are stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (\t).

If you use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy, you may be affected. This vulnerability can be particularly concerning if you use a proxy for request validation or access control. The Twisted Web client and HTTP 2.0 server are not affected by this vulnerability.

How To Fix

Latest published version: 26.4.0 as of 23 Oct 2026

pip install --upgrade "twisted==26.4.0"

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

22.4.0

This is the first release that contains the fix.

pip install --upgrade "twisted==22.4.0"

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If upgrading Twisted is not immediately feasible, you can consider the following workarounds:

Ensure that any upstream proxies you use have addressed the vulnerabilities by upgrading them.
Implement additional filtering or validation mechanisms in your upstream proxy configuration to filter out malformed requests.

Conclusion

In summary, the Twisted Web HTTP 1.1 server has a vulnerability that allows for inconsistent interpretation of HTTP requests, potentially leading to HTTP request smuggling. To mitigate this vulnerability, it is recommended to upgrade to Twisted version 22.4.0 or later. If upgrading immediately is not possible, alternative workarounds such as ensuring upstream proxies are updated or implementing additional filtering can be considered. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for twisted →

FAQ

What is Twisted?

Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including servers, clients, and protocols.

What is the Twisted Web module?

The Twisted Web module is a component of Twisted that includes an HTTP 1.1 server for handling HTTP requests.

What is HTTP request smuggling?

HTTP request smuggling is a technique where an attacker manipulates the interpretation of HTTP requests by different components in the request processing chain, leading to security vulnerabilities or bypassing security controls.

How can this vulnerability impact my application?

If you use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy, this vulnerability can lead to desynchronization and potential HTTP request smuggling. This can be a serious concern if you rely on a proxy for request validation or access control.