{"kind": "product", "path": "vulns/debian-13/twisted", "name": "twisted", "product": "twisted", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-115877", "noindex": false, "published": "2026-10-23T20:25:12.031Z", "modified": "2026-10-23T20:25:12.031Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00326, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115877", "title": "Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incompl", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4", "https://github.com/twisted/twisted/pull/12755", "https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-83813", "noindex": false, "published": "2026-10-23T20:21:54.364Z", "modified": "2026-10-23T20:21:54.364Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-83813", "title": "Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transact", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r", "https://github.com/twisted/twisted/pull/12700", "https://github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115778", "noindex": false, "published": "2026-10-23T20:20:34.591Z", "modified": "2026-10-23T20:55:34.866Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00742, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115778", "title": "Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr", "https://github.com/twisted/twisted/pull/12750", "https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115776", "noindex": false, "published": "2026-10-23T20:18:38.342Z", "modified": "2026-10-23T20:18:38.342Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00742, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115776", "title": "Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798", "https://github.com/twisted/twisted/pull/12771", "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115775", "noindex": false, "published": "2026-10-23T20:16:29.913Z", "modified": "2026-10-23T20:16:29.913Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00658, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115775", "title": "Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73", "https://github.com/twisted/twisted/pull/12751", "https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-115774", "noindex": false, "published": "2026-10-23T20:14:07.480Z", "modified": "2026-10-23T20:14:07.480Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00587, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-115774", "title": "Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v", "https://github.com/twisted/twisted/pull/12764", "https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-106454", "noindex": false, "published": "2026-10-06T19:55:36.523Z", "modified": "2026-10-07T16:26:14.095Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106454", "title": "Twisted: IMAP wildcardToRegexp() ReDoS", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g", "https://github.com/twisted/twisted/pull/12788", "https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42304", "noindex": false, "published": "2026-05-13T20:20:29.149Z", "modified": "2026-05-14T15:45:34.746Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0095, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42304", "title": "Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4", "https://nvd.nist.gov/vuln/detail/CVE-2026-42304"], "fixes": [], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2024-41810", "noindex": false, "published": "2024-07-29T15:41:40.289Z", "modified": "2025-11-03T22:01:01.094Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.01201, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-41810", "title": "HTML injection in HTTP redirect body", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2", "https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33", "https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"], "fixes": ["24.7.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2024-41671", "noindex": false, "published": "2024-07-29T14:37:08.484Z", "modified": "2025-11-03T22:00:59.620Z", "cvss": 8.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "severity": "high", "epss": 0.00863, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-41671", "title": "twisted.web has disordered HTTP pipeline response", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7", "https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33", "https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc"], "fixes": ["24.7.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2023-46137", "noindex": false, "published": "2023-10-25T20:56:27.320Z", "modified": "2025-11-03T21:49:56.068Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00871, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-46137", "title": "twisted.web has disordered HTTP pipeline response", "description": "Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm", "https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-46137"], "fixes": ["23.10.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-39348", "noindex": false, "published": "2022-10-26T00:00:00.000Z", "modified": "2025-11-03T21:46:32.067Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.01586, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-39348", "title": "Twisted vulnerable to NameVirtualHost Host header injection", "description": "Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647", "https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b", "https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4"], "fixes": ["22.4.0-4"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-24801", "noindex": false, "published": "2022-04-04T17:25:10.000Z", "modified": "2025-04-23T18:42:04.506Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.028, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-24801", "title": "HTTP Request Smuggling in twisted.web", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it i", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq", "https://github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac", "https://github.com/twisted/twisted/releases/tag/twisted-22.4.0rc1"], "fixes": ["22.4.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-21716", "noindex": false, "published": "2022-03-03T00:00:00.000Z", "modified": "2025-04-22T18:21:08.759Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0351, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-21716", "title": "Buffer Overflow in Twisted", "description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx", "https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9", "https://github.com/twisted/twisted/releases/tag/twisted-22.2.0"], "fixes": ["22.2.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-21712", "noindex": false, "published": "2022-02-07T00:00:00.000Z", "modified": "2025-04-23T19:07:10.732Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.01381, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-21712", "title": "Cookie and header exposure in twisted", "description": "twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.", "references": ["https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx", "https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2", "https://github.com/twisted/twisted/releases/tag/twisted-22.1.0"], "fixes": ["22.1.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-10108", "noindex": false, "published": "2020-03-12T12:42:33.000Z", "modified": "2024-08-04T10:50:57.819Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.03973, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-10108", "title": "CVE-2020-10108", "description": "In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/", "https://usn.ubuntu.com/4308-2/"], "fixes": ["18.9.0-7"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2020-10109", "noindex": false, "published": "2020-03-12T12:40:05.000Z", "modified": "2024-08-04T10:50:57.900Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.03289, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-10109", "title": "CVE-2020-10109", "description": "In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.", "references": ["https://know.bishopfox.com/advisories", "https://know.bishopfox.com/advisories/twisted-version-19.10.0", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/"], "fixes": ["18.9.0-7"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2016-1000111", "noindex": false, "published": "2020-03-11T19:05:31.000Z", "modified": "2024-08-06T03:55:26.416Z", "cvss": 5.3, "cvss_vector": "", "severity": "medium", "epss": 0.02762, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-1000111", "title": "CVE-2016-1000111", "description": "Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.", "references": ["http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html", "https://www.openwall.com/lists/oss-security/2016/07/18/6", "https://twistedmatrix.com/trac/ticket/8623"], "fixes": ["16.4.0-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2014-7143", "noindex": false, "published": "2019-11-12T13:04:24.000Z", "modified": "2024-08-06T12:40:19.082Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02613, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2014-7143", "title": "CVE-2014-7143", "description": "Python Twisted 14.0 trustRoot is not respected in HTTP client", "references": ["https://security-tracker.debian.org/tracker/CVE-2014-7143", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-7143", "http://www.openwall.com/lists/oss-security/2014/09/22/2"], "fixes": ["14.0.2-1"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}, {"id": "CVE-2019-12855", "noindex": false, "published": "2019-06-16T11:11:43.000Z", "modified": "2024-08-04T23:32:55.450Z", "cvss": 7.4, "cvss_vector": "", "severity": "high", "epss": 0.01809, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-12855", "title": "CVE-2019-12855", "description": "In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.", "references": ["https://twistedmatrix.com/trac/ticket/9561", "https://github.com/twisted/twisted/pull/1147", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ/"], "fixes": ["18.9.0-7"], "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "twisted", "path": "vulns/debian-13/twisted", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 7, "kev": 0}, "lastmod": "2026-10-23T20:55:34.866Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}