CVE-2024-41671 twisted.web has disordered HTTP pipeline response
Attackers can exploit HTTP request pipelining in Twisted to receive responses out of order, potentially leaking sensitive information from other users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41671?
CVE-2024-41671 is a high-severity vulnerability in twisted, published on 29 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
Weakness: CWE-444
Which versions are affected by CVE-2024-41671?
3 open source packages ship an affected version, including twisted.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 24.7.0rc1 |
twisted PyPI | All versions | 24.7.0rc1 |
twisted PyPI | All versions | 24.7.0rc1 |
Linux distribution packages (1)
matrix-synapse openSUSE:Tumbleweed | All versions | 1.112.0-1.1 |
How do I fix CVE-2024-41671?
Upgrade twisted to 24.7.0rc1 or later.
Is CVE-2024-41671 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41671 exists.
Sources
Also known as AZL-47101, AZL-47151, DEBIAN-CVE-2024-41671, GHSA-c8m8-j448-xjx7, PYSEC-2026-1992, UBUNTU-CVE-2024-41671 and 2 more.