CVE-2022-21716: Twisted - SSH Version Identifier Buffer Overflow
Summary
CVE-2022-21716: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Affects twisted across 2 version ranges.
>= 21.7.0, < 22.2.0
< 89c395ee794e85a9657b112c4351417850330ef9
Fixed in 89c395ee794e85a9657b112c4351417850330ef9. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2022-21716 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-based framework for internet applications, supporting Python 3.6+. It provides a set of APIs for building networking applications, including protocols, transports, and services. Twisted includes an SSH client and server implementation. The SSH client and server allow secure communication between hosts over an insecure network. Prior to version 22.2.0, Twisted SSH client and server were vulnerable to a buffer overflow issue in the handling of the peer's SSH version identifier. This vulnerability could be exploited by an attacker to consume all available memory on the system, leading to denial of service. The issue has been addressed in version 22.2.0.
Vulnerability Detail
The vulnerability in Twisted SSH client and server arises from their ability to accept an infinite amount of data for the peer's SSH version identifier. By sending a specially crafted payload, an attacker can cause the buffer to use up all available memory, resulting in a denial of service condition. An example of such a payload is nc -rv localhost 22 < /dev/zero. This vulnerability has the potential to impact systems running vulnerable versions of Twisted, leading to resource exhaustion and service disruption. It is important to note that there are currently no known workarounds for this vulnerability.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
89c395ee794e85a9657b112c4351417850330ef9
This is the first release that contains the fix.
pip install --upgrade "twisted==89c395ee794e85a9657b112c4351417850330ef9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Twisted SSH version identifier buffer overflow vulnerability (CVE-2022-21716) allows an attacker to consume all available memory on the system, resulting in denial of service. It is crucial to upgrade to Twisted version 22.2.0 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted is an event-based framework for internet applications, providing a set of APIs for building networking applications in Python.
The vulnerability allows an attacker to consume all available memory on the system, leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this Twisted SSH version identifier buffer overflow.
No, there are currently no known workarounds for this vulnerability. It is recommended to upgrade to Twisted version 22.2.0 or later.
You can find more information about this vulnerability in the Twisted advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/twisted/PYSEC-2022-160.yaml
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
