Skip to content
OpenAdvisories
Critical DLA-2927-1 3 CVEs

twisted - security update

Published Feb 19, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 twisted 16.6.0-2+deb9u1

Vulnerabilities 3

  • Critical 9.8
    CVE-2020-10108

    Improper Input Validation in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelin…

    twisted twisted twisted python-twisted Debian Ubuntu Azure Linux Alpine PyPI
  • Critical 9.8
    CVE-2020-10109

    HTTP Request Smuggling in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined requ…

    twisted twisted twisted python-twisted Debian Ubuntu Azure Linux Alpine PyPI
  • High 7.5
    CVE-2022-21712

    Cookie and header exposure in twisted

    twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLike…

    twisted twisted twisted twisted Debian Ubuntu Azure Linux Alpine PyPI