Read the docs
TI-2016-09296 Aliases CVE-2016-1000111GHSA-3gqj-cmxr-p4x2

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace…

Priority LOW 29CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-425.

Summary

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Why it matters now

EPSS 0.02762 86th percentileScored 2026-11-07
Fix Fixed Twisted (PyPI): 16.3.1Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Twisted (PyPI)before 16.3.116.3.1Patch availableGHSA-3gqj-cmxr-p4x2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Twisted (PyPI) Vendor— Affected before 16.3.1 Fixed in 16.3.1 Patch available GHSA-3gqj-cmxr-p4x2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*before 16.3.1Vulnerabletwisted
  • cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* Versions before 16.3.1 Vulnerable ·twisted

Remediation

  • Fix · GHSA-3gqj-cmxr-p4x2 Twisted (PyPI) Fixed in 16.3.1 Advisory →

Red Hat 2 advisories

  • RHSA-2018:0273 Released 2018-02-05 · Red Hat rating Important
    Red Hat Satellite 6 security, bug fix, and enhancement update
    • Red Hat Satellite 6.2 candlepin-0.9.54.26-1.el6, candlepin-0.9.54.26-1.el7, candlepin-selinux-0.9.54.26-1.el6 +47
    • Red Hat Satellite Capsule 6.2 foreman-1.11.0.86-1.el6sat, foreman-1.11.0.86-1.el7sat, foreman-debug-1.11.0.86-1.el6sat +47
  • RHSA-2016:1978 Released 2016-09-29 · Red Hat rating Important
    python-twisted-web security update
    • Red Hat Enterprise Linux Client Optional (v. 7) python-twisted-web-12.1.0-5.el7_2
    • Red Hat Enterprise Linux Desktop (v. 6) python-twisted-web-8.2.0-5.el6_8
    • Red Hat Enterprise Linux Server (v. 6) python-twisted-web-8.2.0-5.el6_8
    • Red Hat Enterprise Linux Server Optional (v. 7) python-twisted-web-12.1.0-5.el7_2
    • Red Hat Enterprise Linux Workstation (v. 6) python-twisted-web-8.2.0-5.el6_8
    • Red Hat Enterprise Linux Workstation Optional (v. 7) python-twisted-web-12.1.0-5.el7_2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2016:1978
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2016:1978
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:1978
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2016:1978
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:1978
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2016:1978
Red Hat Satellite 6.2Fixed RHSA-2018:0273
Red Hat Satellite Capsule 6.2Fixed RHSA-2018:0273

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1000111
  2. 2026-10-03 Alias added: GHSA-3gqj-cmxr-p4x2

References

Patch 1

Advisory 4

Other 2

  • TI-2026-30612 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains CVSS 3.1HIGH 7.5
  • TI-2022-06090 Buffer Overflow in Twisted CVSS 3.1HIGH 7.5
  • TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
  • TI-2022-18723 Twisted vulnerable to NameVirtualHost Host header injection CVSS 3.1MEDIUM 5.4
  • TI-2020-08165 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2020-08166 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences