# GHSA-vpp8-g58w-m8mp: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 29 Oct 2026

## What is GHSA-vpp8-g58w-m8mp?

GHSA-vpp8-g58w-m8mp is a vulnerability in Twisted, published on 29 Oct 2026. 

### Official description

## Summary

An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with `END_STREAM` and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487.

## Details

For one received segment the h2 events are processed in order in `H2Connection.dataReceived`. A `HEADERS(END_STREAM)` followed by `RST_STREAM` yields `RequestReceived`, `StreamEnded`, then `StreamReset`, so the request is dispatched and rendered on stream end before the reset is handled:

```python
# src/twisted/web/_http2.py  (H2Connection.dataReceived)
for event in events:
    if isinstance(event, h2.events.RequestReceived):
        self._requestReceived(event)     # allocate the request
    elif isinstance(event, h2.events.StreamEnded):
        self._requestEnded(event)        # -> requestComplete -> render() synchronously
    elif isinstance(event, h2.events.StreamReset):
        self._requestAborted(event)      # processed last, frees the stream
```

`_requestAborted` frees the reset stream, so it never occupies the 100-stream concurrency budget, and nothing in `_http2.py` counts or throttles opened-and-reset streams. The 2019 flood fix (GHSA-32gv) bounds outbound control-frame buffering only and does not apply to this path.

Affected product: Twisted, `twisted.web` HTTP/2 server
Affected versions: confirmed against 26.4.0

## PoC

On any Twisted HTTP/2 endpoint, open one connection and, in a tight loop, send a `HEADERS` frame with `END_STREAM` on a fresh stream identifier immediately followed by a `RST_STREAM` for that stream, at line rate. No credentials are required. The server renders each request on stream end before the reset frees the stream, and a freed stream never counts toward the concurrent-stream limit, so the loop is never throttled.

Because every cancelled stream is still dispatched in full and reset streams do not accumulate, the connection is never throttled or closed, so the forced work grows with the number of pairs sent. Sustained on one connection this saturates a CPU core under only a trickle of traffic, whereas a client that instead leaves its streams open is closed once it reaches the concurrent-stream limit.

## Impact

This is an unauthenticated remote denial of service (CWE-400, CWE-770) by CPU exhaustion. One connection forces unbounded request rendering at a few frames per cancelled request, bypassing the concurrent-stream limit. It is the HTTP/2 Rapid Reset class (CVE-2023-44487), not covered by the earlier Twisted flood fix, with no confidentiality or integrity impact and no code execution.

## Which versions are affected by GHSA-vpp8-g58w-m8mp?

2 open source packages ship an affected version, including Twisted and twisted.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `Twisted` | PyPI | All versions | 26.10.0rc1 |
| `twisted` | PyPI | All versions | 26.10.0rc1 |

## How do I fix GHSA-vpp8-g58w-m8mp?

Upgrade Twisted to 26.10.0rc1 or later.

## Is GHSA-vpp8-g58w-m8mp being exploited?

There is no known exploitation of GHSA-vpp8-g58w-m8mp in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-vpp8-g58w-m8mp and fix it if it is affected.

What it is: GHSA-vpp8-g58w-m8mp is a vulnerability in Twisted, published on 29 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-vpp8-g58w-m8mp in the wild and no public exploit code.

Affected packages and fixed versions:
- Twisted (PyPI): affected all versions; fixed in 26.10.0rc1
- twisted (PyPI): affected all versions; fixed in 26.10.0rc1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-vpp8-g58w-m8mp/ (Markdown: https://insights.sbomify.com/GHSA-vpp8-g58w-m8mp/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-vpp8-g58w-m8mp

---
From sbomify Insights: https://insights.sbomify.com/GHSA-vpp8-g58w-m8mp/
Summaries are generated and may contain mistakes; the official description above is the record.