CVE-2020-10109: HTTP Request Smuggling in Twisted
Summary
CVE-2020-10109: HTTP Request Smuggling in Twisted. Affects twisted versions < 20.3.0. Fixed in 20.3.0. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2020-10109 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is a Python networking framework that provides a variety of protocols, including an HTTP server. It is widely used for developing scalable and event-driven applications. Twisted Web, a component of Twisted, allows developers to build web servers and clients. However, versions up to and including 20.3.0 of Twisted Web are vulnerable to an HTTP request splitting vulnerability.
Vulnerability Detail
The vulnerability in Twisted Web arises when a request contains both a 'Content-Length' header and a 'Transfer-Encoding: chunked' header. In such cases, the 'Content-Length' header takes precedence, causing the remainder of the request body to be interpreted as a pipelined request. This can lead to various security issues, including request smuggling attacks, where an attacker can manipulate the interpretation of subsequent requests and potentially bypass security measures.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.3.0
This is the first release that contains the fix.
pip install --upgrade "twisted==20.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable pipelining in the affected Twisted Web server. This can be achieved by modifying the server configuration to set the 'pipeline' attribute of the 'HTTPChannel' class to False. Here is an example of how to implement this workaround:
from twisted.web import http
class CustomHTTPChannel(http.HTTPChannel):
pipeline = False
# Replace the default HTTPChannel with the custom implementation
http.HTTPFactory.protocol = CustomHTTPChannel
Conclusion
The HTTP request splitting vulnerability in Twisted Web can have serious security implications, allowing attackers to manipulate subsequent requests and potentially bypass security measures. It is crucial to upgrade to Twisted Web version 20.3.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, the provided workaround can be implemented to disable pipelining. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted Web is a component of the Twisted networking framework that allows developers to build web servers and clients using Python. It provides a variety of protocols and features for developing scalable and event-driven web applications.
HTTP request splitting, also known as HTTP request smuggling, is a vulnerability that occurs when an intermediary or server interprets a single HTTP request as multiple requests. This can lead to security issues, such as bypassing security measures or injecting malicious content.
The HTTP request splitting vulnerability in Twisted Web can allow attackers to manipulate the interpretation of subsequent requests, potentially bypassing security measures and gaining unauthorized access to sensitive information. It can also be used to inject malicious content or perform other types of attacks.
Yes, the vulnerability has been fixed in Twisted Web version 20.3.0. It is recommended to upgrade to this version or later to mitigate the risk associated with the HTTP request splitting vulnerability.
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable pipelining in the affected Twisted Web server. This can be achieved by modifying the server configuration to set the 'pipeline' attribute of the 'HTTPChannel' class to False. Refer to the 'workaround' section for more details.
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
