CVE catalog

CVE-2022-21716

twisted: CVE-2022-21716

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Mar 3, 2022, 9:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 3.51% · Oct 25, 2026

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	twisted	sid	`26.4.0-6`	fixed
Debian	twisted	forky	`26.4.0-6`	fixed
Debian	twisted	trixie	`24.11.0-1`	fixed
Debian	twisted	bookworm	`22.4.0-4+deb12u1`	fixed
Debian	twisted	bookworm-security	`22.4.0-4+deb12u1`	fixed
Ubuntu	twisted	pro	`15.2.1-1ubuntu2`	vulnerable
Ubuntu	twisted	pro	`15.5.0-1`	vulnerable
Ubuntu	twisted	pro	`15.5.0-2`	vulnerable
Ubuntu	twisted	pro	`15.5.0-2ubuntu1`	vulnerable
Ubuntu	twisted	pro	`15.5.0-4`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-1ubuntu1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-2ubuntu1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-3`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.2`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.4`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.4+esm1`	fixed
Ubuntu	twisted	22.04	`20.3.0-7ubuntu1`	vulnerable
Ubuntu	twisted	22.04	`20.3.0-7ubuntu3`	vulnerable
Ubuntu	twisted	22.04	`22.1.0-2ubuntu2`	vulnerable
Ubuntu	twisted	22.04	`22.1.0-2ubuntu2.1`	fixed
Opensuse	python-Twisted	tumbleweed	`22.2.0-1.1`	fixed
Suse	python-Twisted	hpe helion openstack 8	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	openstack cloud 8	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	openstack cloud 9	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	openstack cloud crowbar 8	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	openstack cloud crowbar 9	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	linux enterprise module for web and scripting 12	`15.2.1-9.17.1`	fixed
Suse	python-Twisted	linux enterprise module for package hub 15 sp3	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise module for server applications 15 sp3	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise high performance computing 15 sp2-espos	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise high performance computing 15 sp2-ltss	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise server 15 sp2-bcl	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise server 15 sp2-ltss	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise server for sap applications 15 sp2	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	manager proxy 4.1	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	manager retail branch server 4.1	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	manager server 4.1	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	enterprise storage 7	`19.10.0-150200.3.12.1`	fixed
Opensuse	python-Twisted	leap 15.3	`19.10.0-150200.3.12.1`	fixed
Opensuse	python-Twisted	leap 15.4	`19.10.0-150200.3.12.1`	fixed
Suse	python-Twisted	linux enterprise module for server applications 15 sp4	`22.2.0-150400.5.4.1`	fixed
Opensuse	python-Twisted	leap 15.4	`22.2.0-150400.5.4.1`	fixed
Ubuntu	twisted	pro	`15.2.1-1ubuntu2`	vulnerable
Ubuntu	twisted	pro	`15.5.0-1`	vulnerable
Ubuntu	twisted	pro	`15.5.0-2`	vulnerable
Ubuntu	twisted	pro	`15.5.0-2ubuntu1`	vulnerable
Ubuntu	twisted	pro	`15.5.0-4`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-1ubuntu1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-2ubuntu1`	vulnerable
Ubuntu	twisted	pro	`16.0.0~pre1-3`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.2`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.4`	vulnerable
Ubuntu	twisted	pro	`16.0.0-1ubuntu0.4+esm1`	fixed
Ubuntu	twisted	18.04	`16.6.0-2ubuntu3`	vulnerable
Ubuntu	twisted	18.04	`17.9.0-1`	vulnerable
Ubuntu	twisted	18.04	`17.9.0-2`	vulnerable
Ubuntu	twisted	18.04	`17.9.0-2ubuntu0.1`	vulnerable
Ubuntu	twisted	18.04	`17.9.0-2ubuntu0.3`	fixed
Ubuntu	twisted	20.04	`18.9.0-3ubuntu1`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-5`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-6`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-6build1`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-6ubuntu1`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-8`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-11`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-11ubuntu0.20.04.1`	vulnerable
Ubuntu	twisted	20.04	`18.9.0-11ubuntu0.20.04.2`	fixed
Ubuntu	twisted	22.04	`20.3.0-7ubuntu1`	vulnerable
Ubuntu	twisted	22.04	`20.3.0-7ubuntu3`	vulnerable
Ubuntu	twisted	22.04	`22.1.0-2ubuntu2`	vulnerable
Ubuntu	twisted	22.04	`22.1.0-2ubuntu2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	twisted	source	sid	`22.2.0-1`	not yet assigned	Not reported	Not reported
Debian	twisted	source	forky	`22.2.0-1`	not yet assigned	Not reported	Not reported
Debian	twisted	source	trixie	`22.2.0-1`	not yet assigned	Not reported	Not reported
Debian	twisted	source	bookworm	`22.2.0-1`	not yet assigned	Not reported	Not reported
Ubuntu	twisted	deb	pro	`16.0.0-1ubuntu0.4+esm1`	Not reported	USN-5354-2	Not reported
Ubuntu	twisted	deb	22.04	`22.1.0-2ubuntu2.1`	Not reported	USN-5354-2	Not reported
Opensuse	python-Twisted	rpm	tumbleweed	`22.2.0-1.1`	Not reported	OPENSUSE-SU-2024:11978-1	Not reported
Suse	python-Twisted	rpm	hpe helion openstack 8	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	openstack cloud 8	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	openstack cloud 9	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	openstack cloud crowbar 8	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	openstack cloud crowbar 9	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	linux enterprise module for web and scripting 12	`15.2.1-9.17.1`	Not reported	SUSE-SU-2022:2117-1	Not reported
Suse	python-Twisted	rpm	linux enterprise module for package hub 15 sp3	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise module for server applications 15 sp3	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise high performance computing 15 sp2-espos	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise high performance computing 15 sp2-ltss	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise server 15 sp2-bcl	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise server 15 sp2-ltss	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise server for sap applications 15 sp2	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	manager proxy 4.1	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	manager retail branch server 4.1	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	manager server 4.1	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	enterprise storage 7	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Opensuse	python-Twisted	rpm	leap 15.3	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Opensuse	python-Twisted	rpm	leap 15.4	`19.10.0-150200.3.12.1`	Not reported	SUSE-SU-2022:2070-1	Not reported
Suse	python-Twisted	rpm	linux enterprise module for server applications 15 sp4	`22.2.0-150400.5.4.1`	Not reported	SUSE-SU-2022:2297-1	Not reported
Opensuse	python-Twisted	rpm	leap 15.4	`22.2.0-150400.5.4.1`	Not reported	SUSE-SU-2022:2297-1	Not reported
Ubuntu	twisted	deb	pro	`16.0.0-1ubuntu0.4+esm1`	Not reported	UBUNTU-CVE-2022-21716	Not reported
Ubuntu	twisted	deb	18.04	`17.9.0-2ubuntu0.3`	Not reported	UBUNTU-CVE-2022-21716	Not reported
Ubuntu	twisted	deb	20.04	`18.9.0-11ubuntu0.20.04.2`	Not reported	UBUNTU-CVE-2022-21716	Not reported
Ubuntu	twisted	deb	22.04	`22.1.0-2ubuntu2.1`	Not reported	UBUNTU-CVE-2022-21716	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[python313-Twisted]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-all_non_platform]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-conch]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-conch_nacl]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-contextvars]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-http2]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-serial]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python313-Twisted-tls]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-all_non_platform]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-conch]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-conch_nacl]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-contextvars]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-http2]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-serial]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python314-Twisted-tls]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed
[python-Twisted-doc]Unknown
Source package: [python-Twisted]
Details (1)
- 26.4.0-3.3 · noarch · tumbleweed
  Unknown · Fixed: 22.2.0-1.1
  Version impact unknown
  dsa · python-Twisted · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[python3-twisted]Fixed
Source package: [twisted]
Details (4)
- 22.4.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm-security
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm-security
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
[twisted-doc]Fixed
Source package: [twisted]
Details (4)
- 22.4.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm-security
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm
- 22.4.0-4+deb12u1 · all · bookworm-security
  Fixed · Fixed: 22.2.0-1
  dsa · twisted · debian · bookworm

Observed: Oct 23, 2026, 6:24:09 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]