Twisted
16 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Twisted, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Twisted CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High7
- Medium5
Latest CVEs
The 15 most recently published vulnerabilities affecting Twisted.
- CVE-2026-42304Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains7.5
- CVE-2024-41810HTML injection in HTTP redirect body6.1
- CVE-2024-41671twisted.web has disordered HTTP pipeline response8.3
- CVE-2023-46137twisted.web has disordered HTTP pipeline response5.3
- CVE-2022-39348Twisted vulnerable to NameVirtualHost Host header injection5.4
- GHSA-8r99-h8j2-rw64Twisted vulnerable to HTTP Request Smuggling Attacks—
- CVE-2022-24801HTTP Request Smuggling in twisted.web8.1
- GHSA-32gv-6cf3-wcmqHTTP/2 DoS Attacks: Ping, Reset, and Settings Floods—
- CVE-2022-21716Buffer Overflow in Twisted7.5
- CVE-2022-21712Cookie and header exposure in twisted7.5
- CVE-2020-10108In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value ...9.8
- CVE-2020-10109In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the rem...9.8
- CVE-2016-1000111Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_...5.3
- CVE-2014-7143Python Twisted 14.0 trustRoot is not respected in HTTP client7.5
- CVE-2019-12855In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.7.4
Product grouping is registry-driven, with AI assist and human review. How it works