CVE catalog

CVE-2023-46137

twisted: CVE-2023-46137

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.87% · Oct 25, 2026

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantwistedsid26.4.0-6fixed
Debiantwistedforky26.4.0-6fixed
Debiantwistedtrixie24.11.0-1fixed
Debiantwistedbookworm22.4.0-4+deb12u1fixed
Debiantwistedbookworm-security22.4.0-4+deb12u1fixed
Ubuntutwistedpro16.6.0-2ubuntu3vulnerable
Ubuntutwistedpro17.9.0-1vulnerable
Ubuntutwistedpro17.9.0-2vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm1vulnerable
Ubuntutwistedpro17.9.0-2ubuntu0.3+esm2vulnerable
Ubuntutwisted20.0418.9.0-3ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-5vulnerable
Ubuntutwisted20.0418.9.0-6vulnerable
Ubuntutwisted20.0418.9.0-6build1vulnerable
Ubuntutwisted20.0418.9.0-6ubuntu1vulnerable
Ubuntutwisted20.0418.9.0-8vulnerable
Ubuntutwisted20.0418.9.0-11vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.1vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.2vulnerable
Ubuntutwisted20.0418.9.0-11ubuntu0.20.04.3fixed
Ubuntutwisted22.0420.3.0-7ubuntu1vulnerable
Ubuntutwisted22.0420.3.0-7ubuntu3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.1vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.3vulnerable
Ubuntutwisted22.0422.1.0-2ubuntu2.4fixed
Ubuntutwisted24.0422.4.0-4vulnerable
Ubuntutwisted24.0422.4.0-4ubuntu1fixed
Opensusepython-Twistedleap 15.419.10.0-150200.3.21.1fixed
Susepython3-Twistedlinux enterprise module for server applications 15 sp422.2.0-150400.15.1fixed
Susepython3-Twistedlinux enterprise module for server applications 15 sp522.2.0-150400.15.1fixed
Opensusepython3-Twistedleap 15.422.2.0-150400.15.1fixed
Opensusepython3-Twistedleap 15.522.2.0-150400.15.1fixed
Susepython-Twistedlinux enterprise module for public cloud 15 sp117.9.0-150000.3.11.1fixed
Susepython-Twistedlinux enterprise module for python 3 15 sp422.10.0-150400.5.13.1fixed
Susepython-Twistedlinux enterprise module for python 3 15 sp522.10.0-150400.5.13.1fixed
Opensusepython-Twistedleap 15.422.10.0-150400.5.13.1fixed
Opensusepython-Twistedleap 15.522.10.0-150400.5.13.1fixed
Opensusepython-Twistedtumbleweed22.10.0-9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantwistedsourcesid23.10.0-1not yet assignedNot reported[1054913]
Debiantwistedsourceforky23.10.0-1not yet assignedNot reported[1054913]
Debiantwistedsourcetrixie23.10.0-1not yet assignedNot reported[1054913]
Debiantwistedsourcebookworm22.4.0-4+deb12u1not yet assignedNot reported[1054913]
Ubuntutwisteddeb20.0418.9.0-11ubuntu0.20.04.3Not reportedUBUNTU-CVE-2023-46137Not reported
Ubuntutwisteddeb22.0422.1.0-2ubuntu2.4Not reportedUBUNTU-CVE-2023-46137Not reported
Ubuntutwisteddeb24.0422.4.0-4ubuntu1Not reportedUBUNTU-CVE-2023-46137Not reported
Opensusepython-Twistedrpmleap 15.419.10.0-150200.3.21.1Not reportedSUSE-SU-2023:4490-1Not reported
Susepython3-Twistedrpmlinux enterprise module for server applications 15 sp422.2.0-150400.15.1Not reportedSUSE-SU-2023:4607-1Not reported
Susepython3-Twistedrpmlinux enterprise module for server applications 15 sp522.2.0-150400.15.1Not reportedSUSE-SU-2023:4607-1Not reported
Opensusepython3-Twistedrpmleap 15.422.2.0-150400.15.1Not reportedSUSE-SU-2023:4607-1Not reported
Opensusepython3-Twistedrpmleap 15.522.2.0-150400.15.1Not reportedSUSE-SU-2023:4607-1Not reported
Susepython-Twistedrpmlinux enterprise module for public cloud 15 sp117.9.0-150000.3.11.1Not reportedSUSE-SU-2023:4830-1Not reported
Susepython-Twistedrpmlinux enterprise module for python 3 15 sp422.10.0-150400.5.13.1Not reportedSUSE-SU-2023:4608-1Not reported
Susepython-Twistedrpmlinux enterprise module for python 3 15 sp522.10.0-150400.5.13.1Not reportedSUSE-SU-2023:4608-1Not reported
Opensusepython-Twistedrpmleap 15.422.10.0-150400.5.13.1Not reportedSUSE-SU-2023:4608-1Not reported
Opensusepython-Twistedrpmleap 15.522.10.0-150400.5.13.1Not reportedSUSE-SU-2023:4608-1Not reported
Opensusepython-Twistedrpmtumbleweed22.10.0-9.1Not reportedOPENSUSE-SU-2024:13430-1Not reported

[Debian bug #1054913]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]