Login
All errata/c10f2/ALT-PU-2026-17614-4
ALT-PU-2026-17614-4

Package update python3-module-twisted-core in branch c10f2

Version22.10.0-alt3.c10f2.1
Task#435334
Published2026-10-09
Max severityHIGH
Severity:

Closed issues (13)

BDU:2024-01299
MEDIUM5.3

Уязвимость компонента twisted.web сетевого фреймворка Twisted, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Published: 2024-02-14Modified: 2026-05-26
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
References
BDU:2024-06573
HIGH8.3

Уязвимость компонента twisted.web сетевого фреймворка Twisted, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2024-08-29Modified: 2025-09-22
CVSS 3.xHIGH 8.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2025-04172
MEDIUM6.1

Уязвимость функции twisted.web.util.redirectTo сетевого фреймворка Twisted, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность

Published: 2025-04-09Modified: 2026-01-11
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
CVE-2023-46137
MEDIUM5.3

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

Published: 2023-10-25Modified: 2026-06-17
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2024-41671
HIGH8.3

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

Published: 2024-07-29Modified: 2026-06-17
CVSS 3.xHIGH 8.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
References
CVE-2024-41810
MEDIUM6.1

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.

Published: 2024-07-29Modified: 2026-06-17
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2026-106454
MEDIUM4.3

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.

Published: 2026-10-06Modified: 2026-10-07
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
CVE-2026-42304
HIGH7.5

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.

Published: 2026-05-13Modified: 2026-06-17
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-c8m8-j448-xjx7
MEDIUM6.9

twisted.web has disordered HTTP pipeline response

Published: 2024-07-29Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
References
GHSA-cf56-g6w6-pqq2
MEDIUM5.3

Twisted vulnerable to HTML injection in HTTP redirect body

Published: 2024-07-29Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
GHSA-grgv-6hw6-v9g4
HIGH7.5

Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

Published: 2026-05-05Modified: 2026-06-08
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-xc8x-vp79-p3wm
MEDIUM6.9

twisted.web has disordered HTTP pipeline response

Published: 2023-10-25Modified: 2025-11-04
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References