CVE-2023-46137

🔶 medium

Summary

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

CVSS Score

5.3

Medium

EPSS Score

0.6

Exploit Probability

Published Date

2023-10-25

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.7% of all 328,009 vulnerabilities in our database.

#263,349

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Sep 10, 2024

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2025-11-03

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE IDs (Weakness Types)

CWE-444

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
twisted	twisted	Affected	≤ 22.8.0

🔗 References 2

https://github.com/twisted/twisted/security/advisori...

Exploit Vendor Advisory

https://lists.debian.org/debian-lts-announce/2024/11...

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42304	⚠️ high	7.5	0.0	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.n...	2026-05-13
CVE-2024-41810	🔶 medium	6.1	68.2	Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo`...	2024-07-29
CVE-2022-39348	🔶 medium	5.4	1.2	Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not...	2022-10-26
CVE-2022-24801	⚠️ high	8.1	1.2	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the T...	2022-04-04
CVE-2022-21716	⚠️ high	7.5	1.0	Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH clie...	2022-03-03
CVE-2022-21712	⚠️ high	7.5	0.2	twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authori...	2022-02-07

These CVEs affect the same products