# twisted (PyPI) vulnerabilities 22 known vulnerabilities (9 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 26.10.0 (Oct 30, 2026): no advisory affects it - Newest unaffected release: 26.10.0 (Oct 30, 2026), the latest release - Weekly downloads: 3.7M - Dependents: 1,493 - Releases: 99 since 2.1.0 - Registry: https://pypi.org/project/twisted/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GHSA-VPP8-G58W-M8MP: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-115877: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-83813: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-115778: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-115776: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-115775: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-115774: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-106454: 2.1.0 to 26.4.0 (26.10.0rc1 is outside it) - CVE-2026-42304: 2.1.0 to 26.4.0rc2 (26.4.0 is outside it) - CVE-2024-41810: 2.1.0 to 24.3.0 (24.7.0rc1 is outside it) - CVE-2024-41671: 2.1.0 to 24.3.0 (24.7.0rc1 is outside it) - CVE-2023-46137: 2.1.0 to 23.8.0 (23.10.0rc1 is outside it) - CVE-2022-39348: 2.1.0 to 22.8.0 (22.10.0rc1 is outside it) - CVE-2022-24801: 2.1.0 to 22.4.0rc1 (22.4.0 is outside it) - CVE-2022-21716: 21.7.0 to 22.2.0rc1 (22.2.0 is outside it) - CVE-2022-21712: 11.1.0 to 22.1.0rc1 (22.1.0 is outside it) - CVE-2020-10108: 2.1.0 to 20.3.0rc1 (20.3.0 is outside it) - CVE-2020-10109: 2.1.0 to 20.3.0rc1 (20.3.0 is outside it) - CVE-2016-1000111: 2.1.0 to 16.3.0 (16.3.1 is outside it) - CVE-2014-7143: 2.1.0 to 14.0.0 (14.0.1 is outside it) - CVE-2019-12855: 2.1.0 to 19.2.1 (19.7.0rc1 is outside it) - CVE-2019-12387: 2.1.0 to 19.2.0 (19.2.1 is outside it) ## Advisories (22) ### [GHSA-VPP8-G58W-M8MP](https://cve.now/GHSA-VPP8-G58W-M8MP): Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset - Severity: High - Published: Oct 29, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 7 days before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-115877](https://cve.now/CVE-2026-115877): Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value - Severity: Medium 5.4 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-83813](https://cve.now/CVE-2026-83813): Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation - Severity: Low 3.1 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-115778](https://cve.now/CVE-2026-115778): Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer - Severity: High 7.5 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-115776](https://cve.now/CVE-2026-115776): Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer - Severity: High 7.5 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-115775](https://cve.now/CVE-2026-115775): Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree - Severity: High 8.7 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-115774](https://cve.now/CVE-2026-115774): Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH - Severity: Medium 4.9 - Published: Oct 23, 2026 - Affected: fixed in 26.10.0rc1. - Fixed in 26.10.0rc1 (released Oct 22, 2026, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2026-106454](https://cve.now/CVE-2026-106454): Twisted: IMAP wildcardToRegexp() ReDoS - Severity: Medium 4.3 - Published: Oct 6, 2026 - Affected: through 26.4.0; through 25.5.0. - Fixed in 26.10.0 (released Oct 30, 2026, 24 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 26.10.0, is not affected. ### [CVE-2026-42304](https://cve.now/CVE-2026-42304): Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains - Severity: High 7.5 - Published: May 13, 2026 - Affected: fixed in 26.4.0; fixed in 26.4.0rc2. - Fixed in 26.4.0 (released May 11, 2026, 2 days before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2024-41810](https://cve.now/CVE-2024-41810): HTML injection in HTTP redirect body - Severity: Medium 6.1 - Published: Jul 29, 2024 - Affected: fixed in 24.7.0rc1. - Fixed in 24.7.0rc1 (released Jul 29, 2024, the day of disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2024-41671](https://cve.now/CVE-2024-41671): twisted.web has disordered HTTP pipeline response - Severity: High 8.3 - Published: Jul 29, 2024 - Affected: fixed in 24.7.0rc1. - Fixed in 24.7.0rc1 (released Jul 29, 2024, the day of disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2023-46137](https://cve.now/CVE-2023-46137): twisted.web has disordered HTTP pipeline response - Severity: Medium 5.3 - Published: Oct 25, 2023 - Affected: fixed in 23.10.0rc1; fixed in 23.10.0rc1. - Fixed in 23.10.0rc1 (released Oct 24, 2023, 1 day before disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2022-39348](https://cve.now/CVE-2022-39348): Twisted vulnerable to NameVirtualHost Host header injection - Severity: Medium 5.4 - Published: Oct 26, 2022 - Affected: from 0.9.4, fixed in 22.10.0rc1. - Fixed in 22.10.0rc1 (released Oct 26, 2022, the day of disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2022-24801](https://cve.now/CVE-2022-24801): HTTP Request Smuggling in twisted.web - Severity: High 8.1 - Published: Apr 4, 2022 - Affected: fixed in 22.4.0. - Fixed in 22.4.0 (released Apr 11, 2022, 7 days after disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2022-21716](https://cve.now/CVE-2022-21716): Buffer Overflow in Twisted - Severity: High 7.5 - Published: Mar 3, 2022 - Affected: from 21.7.0, fixed in 22.2.0. - Fixed in 22.2.0 (released Mar 3, 2022, the day of disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2022-21712](https://cve.now/CVE-2022-21712): Cookie and header exposure in twisted - Severity: High 7.5 - Published: Feb 7, 2022 - Affected: from 11.1.0, fixed in 22.1.0. - Fixed in 22.1.0 (released Feb 7, 2022, the day of disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2020-10108](https://cve.now/CVE-2020-10108): In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. - Severity: Unrated - Published: Mar 12, 2020 - Affected: fixed in 20.3.0rc1; fixed in 20.3.0. - Fixed in 20.3.0 (released Mar 20, 2020, 8 days after disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2020-10109](https://cve.now/CVE-2020-10109): In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. - Severity: Unrated - Published: Mar 12, 2020 - Affected: fixed in 20.3.0; fixed in 20.3.0rc1. - Fixed in 20.3.0 (released Mar 20, 2020, 8 days after disclosure). - The latest release, 26.10.0, is not affected. ### [CVE-2016-1000111](https://cve.now/CVE-2016-1000111): Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI… - Severity: Unrated - Published: Mar 11, 2020 - Affected: fixed in 16.3.1. - Fixed in 16.3.1. - The latest release, 26.10.0, is not affected. ### [CVE-2014-7143](https://cve.now/CVE-2014-7143): Python Twisted 14.0 trustRoot is not respected in HTTP client - Severity: Unrated - Published: Nov 12, 2019 - Affected: from 14.0.0, fixed in 14.0.1; fixed in 14.0.1. - Fixed in 14.0.1. - The latest release, 26.10.0, is not affected. ### [CVE-2019-12855](https://cve.now/CVE-2019-12855): In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an… - Severity: Unrated - Published: Jun 16, 2019 - Affected: fixed in 19.7.0rc1; fixed in 19.7.0rc1. - Fixed in 19.7.0rc1. - The latest release, 26.10.0, is not affected. ### [CVE-2019-12387](https://cve.now/CVE-2019-12387): In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters… - Severity: Unrated - Published: Jun 10, 2019 - Affected: fixed in 19.2.1; fixed in 19.2.1. - Fixed in 19.2.1. - The latest release, 26.10.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/twisted Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.