Twisted vulnerabilities
We track 8 vulnerabilities in Twisted products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Twisted vulnerabilities
- 7.5 High severity
twisted: Uncontrolled Resource Consumption
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, withou
- 7.5 High severity
twisted: Uncontrolled Resource Consumption
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line len
- 8.7 High severity
twisted: Uncontrolled Resource Consumption
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding
- 7.5 High severity
twisted: Uncontrolled Resource Consumption
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticat
- 8.3 High severity
twisted: Inconsistent Interpretation of HTTP Requests
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is f
- 8.1 High severity
twisted: Inconsistent Interpretation of HTTP Requests
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted b
- 7.5 High severity
twisted: Allocation of Resources Without Limits or Throttling
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using
- 7.5 High severity
twisted: Origin Validation Error
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeR