TI-2022-18723 Aliases CVE-2022-39348 GHSA-vg46-2rrj-3647

Twisted vulnerable to NameVirtualHost Host header injection

MEDIUM 58CWE-79Published 2022-10-26 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01586 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial twisted (twisted): 22.10.0rc1Twisted (PyPI): 22.10.0rc1Red Hat: 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
twisted	twisted	0.9.4 to before 22.10.0rc1	22.10.0rc1	Patch available	CNA
—	Twisted (PyPI)	0.9.4 to before 22.10.0rc1	22.10.0rc1	Patch available	GHSA-vg46-2rrj-3647

twisted Vendortwisted Affected 0.9.4 to before 22.10.0rc1 Fixed in 22.10.0rc1 Patch available CNA
Twisted (PyPI) Vendor— Affected 0.9.4 to before 22.10.0rc1 Fixed in 22.10.0rc1 Patch available GHSA-vg46-2rrj-3647

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:twisted:twisted::::::::	0.9.4 to before 22.10.0	Vulnerable	twisted
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* Versions 0.9.4 to before 22.10.0 Vulnerable ·twisted
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA twisted (twisted) Fixed in 22.10.0rc1
Fix · GHSA-vg46-2rrj-3647 Twisted (PyPI) Fixed in 22.10.0rc1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Ansible Automation Platform 1.2	Affected	No fix yet
Red Hat Ansible Automation Platform 2	Affected	No fix yet
Red Hat Ceph Storage 3	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 16.1	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix planned: Will not fix
Red Hat Storage 3	Affected	No fix planned: Out of support scope
Service Telemetry Framework 1.3 for RHEL 8	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2022-39348
2026-10-03 Alias added: GHSA-vg46-2rrj-3647

References

Exploit 1

https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647

Patch 2

Advisory 3

Other 2

TI-2026-30612 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains CVSS 3.1HIGH 7.5
TI-2022-06090 Buffer Overflow in Twisted CVSS 3.1HIGH 7.5
TI-2024-27854 HTML injection in HTTP redirect body CVSS 3.1MEDIUM 6.1
TI-2020-08165 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
TI-2020-08166 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. CVSS 3.1CRITICAL 9.8
TI-2022-08614 HTTP Request Smuggling in twisted.web CVSS 3.1HIGH 8.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences