Read the docs
TI-2022-06090 Aliases CVE-2022-21716GHSA-rv6r-3f5q-9rgx

Buffer Overflow in Twisted

Priority HIGH 72CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0351 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial twisted (twisted): 22.2.0twisted (PyPI): 22.2.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
twistedtwistedbefore 22.2.022.2.0Patch availableCNA
—twisted (PyPI)21.7.0 to before 22.2.022.2.0Patch availableGHSA-rv6r-3f5q-9rgx
  • twisted Vendortwisted Affected before 22.2.0 Fixed in 22.2.0 Patch available CNA
  • twisted (PyPI) Vendor— Affected 21.7.0 to before 22.2.0 Fixed in 22.2.0 Patch available GHSA-rv6r-3f5q-9rgx

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*21.7.0 to before 22.2.0Vulnerabletwisted
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*8.8VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* Versions 21.7.0 to before 22.2.0 Vulnerable ·twisted
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA twisted (twisted) Fixed in 22.2.0
  • Fix · GHSA-rv6r-3f5q-9rgx twisted (PyPI) Fixed in 22.2.0 Advisory →

Red Hat 2 advisories

  • RHSA-2022:0982 Released 2022-03-24 · Red Hat rating Important
    Red Hat OpenStack Platform 16.1 (python-twisted) security update
    • Red Hat OpenStack Platform 16.1 python-twisted-16.4.1-19.el8ost, python3-twisted-16.4.1-19.el8ost
  • RHSA-2022:0992 Released 2022-03-23 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2 (python-twisted) security update
    • Red Hat OpenStack Platform 16.2 python-twisted-16.4.1-19.el8ost, python3-twisted-16.4.1-19.el8ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Service Telemetry Framework 1.3 for RHEL 8AffectedNo fix yet
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:0982
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:0992

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21716
  2. 2026-10-03 Alias added: GHSA-rv6r-3f5q-9rgx

References

Exploit 1

Patch 2

Advisory 7

Other 7

  • TI-2026-30612 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains CVSS 3.1HIGH 7.5
  • TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
  • TI-2022-18723 Twisted vulnerable to NameVirtualHost Host header injection CVSS 3.1MEDIUM 5.4
  • TI-2020-08165 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2020-08166 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
  • TI-2022-08614 HTTP Request Smuggling in twisted.web CVSS 3.1HIGH 8.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences