Skip to content
Fencer Intel
high 8.1

CVE-2022-24801 json

HTTP Request Smuggling in twisted.web

published 4y ago modified 4mo ago also GHSA-c2jg-hw38-jrqq , PYSEC-2022-195 , EUVD-2022-0345

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.

Patch / fix

  • pypi twisted 22.4.0
  • twisted twisted 22.4.0
  • twisted Debian 14, Debian 13, Debian 12 22.4.0-1

debian advisories DEBIAN-CVE-2022-24801

  • twisted Ubuntu 22.04 LTS 22.1.0-2ubuntu2.3

ubuntu advisories UBUNTU-CVE-2022-24801

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-twisted-web RHEL 7 12.1.0-8.el7_9
  • python-twisted openstack 16.2, openstack 16.1 16.4.1-20.el8ost
  • python3-twisted openstack 16.2, openstack 16.1 16.4.1-20.el8ost

red hat advisories RHSA-2022:4930RHSA-2022:1646RHSA-2022:1645

  • python-Twisted SLE Module for Web and Scripting 12, OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8 +3 more 15.2.1-9.14.1
  • python-Twisted SLE Real Time 15 SP2, SLE Module for Server Applications 15 SP3, SLE Module for Package Hub 15 SP3 +2 more 19.10.0-150200.3.9.1

suse advisories SUSE-SU-2022:1546-1SUSE-SU-2022:1477-1

  • python-Twisted openSUSE Tumbleweed 22.2.0-1.1

opensuse advisories openSUSE-SU-2024:11978-1

  • py3-twisted Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 22.4.0-r0

alpine advisories ALPINE-CVE-2022-24801

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-24801 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24801 updated cvss 8.1

python-twisted: possible http request smuggling

  • Red Hat Ceph Storage 2 python-twisted Red Hat Ceph Storage 3 python-twisted Red Hat Enterprise Linux 6 python-twisted
    affected: workaround, no fix planned “Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.”
  • Red Hat OpenStack Platform 13 (Queens) python-twisted Red Hat Satellite 6 python-twisted, python2-twisted Red Hat Service Telemetry Framework 1.3 for RHEL 8 python-twisted
    affected: workaround, no fix available “Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.”
  • Red Hat Enterprise Linux Client Optional (v. 7) python-twisted-web 12.1.0-8.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-twisted-web 12.1.0-8.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) python-twisted-web 12.1.0-8.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) python-twisted-web 12.1.0-8.el7_9
    fixed: vendor fix “Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.” RHSA-2022:4930
  • Red Hat OpenStack Platform 16.1 python-twisted 16.4.1-20.el8ost, python3-twisted 16.4.1-20.el8ost
    fixed: vendor fix “Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.” RHSA-2022:1646
  • Red Hat OpenStack Platform 16.2 python-twisted 16.4.1-20.el8ost, python3-twisted 16.4.1-20.el8ost
    fixed: vendor fix “Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.” RHSA-2022:1645

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

2.80% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi twisted
<22.4.0
22.4.0

Affected products

  • twisted twisted

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.