CVE-2020-10109: HTTP Request Splitting Vulnerability in Twisted
Summary
CVE-2020-10109: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. Affects twisted versions < 20.3.0rc1. Fixed in 20.3.0rc1. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2020-10109 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is a popular event-driven networking engine written in Python. It provides a framework for building networked applications, including web servers. Twisted Web, a component of Twisted, allows developers to create web servers and clients. However, versions of Twisted Web up to 19.10.0 are vulnerable to an HTTP request splitting vulnerability.
Vulnerability Detail
The vulnerability in Twisted Web allows an attacker to manipulate HTTP requests by exploiting a flaw in the handling of content-length and chunked encoding headers. When both headers are present, the content-length header takes precedence, causing the remainder of the request body to be interpreted as a pipelined request. This can lead to various security issues, including cache poisoning, cross-site scripting (XSS), and session hijacking.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.3.0rc1
This is the first release that contains the fix.
pip install --upgrade "twisted==20.3.0rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Twisted to mitigate the risk.
Conclusion
The HTTP request splitting vulnerability in Twisted Web can have serious security implications. It is crucial to upgrade to the fixed version of Twisted to protect your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted is an event-driven networking engine written in Python. It provides a framework for building networked applications, including web servers.
The vulnerability allows an attacker to manipulate HTTP requests, potentially leading to cache poisoning, cross-site scripting (XSS), and session hijacking.
To fix this vulnerability, upgrade to Twisted version 20.3.0rc1 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
You can find more information about this vulnerability in the Twisted advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/twisted/PYSEC-2020-260.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
