CVE-2023-46137: twisted.web has disordered HTTP pipeline response
Vulnerability summary
CVE-2023-46137 is a medium (CVSS 5.3) vulnerability in twisted. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 59.1% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 1Timeline
- 25-10-2023PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
Increase +0.11 pp
From 0.77% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundTwisted
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse5 products
- python-Twisted&distro=openSUSE Leap 15.4< 19.10.0-150200.3.21.1 | < 22.10.0-150400.5.13.1
- python-Twisted&distro=openSUSE Leap 15.5< 22.10.0-150400.5.13.1
- python-Twisted&distro=openSUSE Tumbleweed< 22.10.0-9.1
- python3-Twisted&distro=openSUSE Leap 15.4< 22.2.0-150400.15.1
- python3-Twisted&distro=openSUSE Leap 15.5< 22.2.0-150400.15.1
Suse5 products
- python-Twisted&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP1< 17.9.0-150000.3.11.1
- python-Twisted&distro=SUSE Linux Enterprise Module for Python 3 15 SP4< 22.10.0-150400.5.13.1
- python-Twisted&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 22.10.0-150400.5.13.1
- python3-Twisted&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 22.2.0-150400.15.1
- python3-Twisted&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 22.2.0-150400.15.1
Redhat4 products
- python-twisted< 0:16.4.1-21.el8ost
- python-twisted-debugsource< 0:16.4.1-21.el8ost
- python3-twisted< 0:16.4.1-21.el8ost
- python3-twisted-debuginfo< 0:16.4.1-21.el8ost
Debian1 product
- twisted< 22.4.0-4+deb12u1 | < 23.10.0-1
PyPI1 product
- twisted< 23.10.0rc1
Twisted1 product
- twisted23.10.0rc1 | ≤ 22.8.0
Ubuntu1 product
- twistedAll versions (No fix recorded) | < 18.9.0-11ubuntu0.20.04.3 | < 22.1.0-2ubuntu2.4 | < 22.4.0-4ubuntu1
7 vendors · 18 products
References
22 links- github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wmX Refsource CONFIRMWEBAdvisoryREPORTExploitVendor Advisory
- github.com/twisted/twistedPACKAGE