TI-2026-79985 CVE-2026-115775 · GHSA-3476-c5c2-fr73
Unauthenticated memory exhaustion in Twisted domish XML parser
Priority HIGH 77
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
twisted
Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
twisted records in CISA KEVNo twisted vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
22 records
TI-2026-30612 CVE-2026-42304 · GHSA-grgv-6hw6-v9g4
Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Priority HIGH 72
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2022-06090 CVE-2022-21716 · GHSA-rv6r-3f5q-9rgx
Buffer Overflow in Twisted
Priority HIGH 72
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2024-27732 CVE-2024-41671 · GHSA-c8m8-j448-xjx7
twisted.web has disordered HTTP pipeline response
Priority HIGH 69
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2024-27854 CVE-2024-41810 · GHSA-cf56-g6w6-pqq2
HTML injection in HTTP redirect body
Priority MEDIUM 60
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2026-79989 CVE-2026-115877 · GHSA-q7qq-6mhp-9rc4
HTTP request smuggling in Twisted web via bare CR or LF in headers
Priority MEDIUM 58
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2022-18723 CVE-2022-39348 · GHSA-vg46-2rrj-3647
Twisted vulnerable to NameVirtualHost Host header injection
Priority MEDIUM 58
Twisted is an event-based framework for internet applications.
TI-2026-79984 CVE-2026-115774 · GHSA-2qrf-pqgx-qh9v
Denial of service in Twisted IMAP4 server via negative SEARCH literal
Priority MEDIUM 56
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2026-68934 CVE-2026-106454 · GHSA-8pqf-f4m5-798g
Catastrophic regex backtracking in Twisted IMAP wildcard matching
Priority MEDIUM 53
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2020-08165 CVE-2020-10108 · GHSA-h96w-mmrf-2h6v
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.
Priority MEDIUM 49
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.
TI-2026-79995 CVE-2026-83813 · GHSA-jj36-9pvh-vj5r
DNS response spoofing in Twisted names lacks source address checks
Priority MEDIUM 48
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2020-08166 CVE-2020-10109 · GHSA-p5xh-vx83-mxcj
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.
Priority MEDIUM 48
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability.
TI-2022-08614 CVE-2022-24801 · GHSA-c2jg-hw38-jrqq
HTTP Request Smuggling in twisted.web
Priority MEDIUM 42
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2022-06087 CVE-2022-21712 · GHSA-92x2-jw7w-xvvx
Cookie and header exposure in twisted
Priority MEDIUM 42
twisted is an event-driven networking engine written in Python.
TI-2026-79987 CVE-2026-115778 · GHSA-cwm5-jh59-mwxr
Unauthenticated DoS in Twisted Telnet via Unbounded Buffer
Priority MEDIUM 40
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2026-79986 CVE-2026-115776 · GHSA-53xc-49m8-p798
Unbounded buffer in Twisted IRC server allows remote denial of service
Priority LOW 39
Twisted is an event-based framework for internet applications, supporting Python 3.6+.
TI-2014-05963 CVE-2014-7143 · GHSA-3c45-wgjp-7v9r
Python Twisted 14.0 trustRoot is not respected in HTTP client
Priority LOW 38
Python Twisted 14.0 trustRoot is not respected in HTTP client
TI-2019-09631 CVE-2019-12855 · GHSA-65rm-h285-5cc5
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not…
Priority LOW 36
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
TI-2023-24779 CVE-2023-46137 · GHSA-xc8x-vp79-p3wm
twisted.web has disordered HTTP pipeline response
Priority LOW 32
Twisted is an event-based framework for internet applications.
TI-2019-09235 CVE-2019-12387 · GHSA-6cc5-2vg4-cc7m
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods…
Priority LOW 32
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
TI-2022-07660 CVE-2022-23607 · GHSA-fhpf-pp6p-55qc
Unsafe handling of user-specified cookies in treq
Priority LOW 31
treq is an HTTP library inspired by requests but written on top of Twisted's Agents.
TI-2016-09296 CVE-2016-1000111 · GHSA-3gqj-cmxr-p4x2
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace…
Priority LOW 29
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment varia…