CVE-2022-24801: Twisted HTTP Request Smuggling
Summary
CVE-2022-24801: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Affects twisted across 2 version ranges.
< 22.4.0
< 592217e951363d60e9cd99c5bbfd23d4615043ac
Fixed in 592217e951363d60e9cd99c5bbfd23d4615043ac. How to fix ↓
Also tracked for
- twisted · Debian:11
The same CVE-2022-24801 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twisted is an event-based framework for internet applications, supporting Python 3.6+. It provides various functionalities for building networked applications, including a web server and proxy. The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, is responsible for handling HTTP requests. However, prior to version 22.4.0rc1, this server parsed certain HTTP request constructs more leniently than allowed by RFC 7230. This non-conformant parsing can lead to desynchronization if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. It's important to note that the Twisted Web client and HTTP 2.0 server are not affected by this vulnerability.
Vulnerability Detail
The Twisted Web HTTP 1.1 server's non-conformant parsing of HTTP request constructs can result in desynchronization if requests pass through multiple HTTP parsers. This can lead to HTTP request smuggling, where an attacker can manipulate the requests to bypass security measures or perform unauthorized actions. The vulnerability can be exploited if users are using Twisted Web's HTTP 1.1 server and/or proxy and also passing requests through a different HTTP server and/or proxy.
How To Fix
Latest published version: 26.4.0 as of 23 Oct 2026
pip install --upgrade "twisted==26.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
592217e951363d60e9cd99c5bbfd23d4615043ac
This is the first release that contains the fix.
pip install --upgrade "twisted==592217e951363d60e9cd99c5bbfd23d4615043ac"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Twisted is not immediately feasible, there are two workarounds available:
- Ensure that any vulnerabilities in upstream proxies have been addressed by upgrading them to the latest versions.
- Filter malformed requests by other means, such as configuring an upstream proxy to block or sanitize requests that could trigger the vulnerability.
Conclusion
The Twisted Web HTTP 1.1 server in Twisted versions prior to 22.4.0rc1 is vulnerable to HTTP request smuggling due to non-conformant parsing of certain HTTP request constructs. To address this vulnerability, users should upgrade their Twisted package to at least version 22.4.0. Alternatively, they can ensure that upstream proxies are updated to fix any vulnerabilities or implement request filtering in upstream proxies. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for twisted →
FAQ
Twisted is an event-based framework for internet applications, written in Python. It provides a wide range of functionality for building networked applications, including support for protocols like HTTP, SMTP, and SSH.
HTTP request smuggling is a technique where an attacker manipulates the HTTP requests to bypass security measures or perform unauthorized actions. It takes advantage of inconsistencies or vulnerabilities in the parsing of HTTP requests by different components in the request processing chain.
Versions of Twisted prior to 22.4.0rc1 are affected by this vulnerability. Users should upgrade to at least version 22.4.0 to mitigate the issue.
No, the Twisted Web client is not affected by this vulnerability. Only the Twisted Web HTTP 1.1 server, located in the twisted.web.http module, is vulnerable.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for twisted.
