CVE-2023-46137

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-46137
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46137.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-46137
Aliases
Downstream
Related
Published
2023-10-25T20:56:27.320Z
Modified
2026-03-13T07:45:31.730724Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
twisted.web has disordered HTTP pipeline response
Details

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-444"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46137.json"
}
References

Affected packages

Git / github.com/twisted/twisted

Affected ranges

Type
GIT
Repo
https://github.com/twisted/twisted
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
61c46d40eb65e7aaeaf4f2b10f6696427d1401b3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "23.10.0rc1"
        }
    ]
}

Affected versions

Other
before-black
twisted-16.*
twisted-16.2.0
twisted-16.3.0
twisted-16.4.0
twisted-16.4.1
twisted-16.5.0
twisted-16.6.0
twisted-17.*
twisted-17.1.0
twisted-17.5.0
twisted-17.9.0
twisted-18.*
twisted-18.4.0
twisted-18.7.0
twisted-18.9.0
twisted-19.*
twisted-19.2.0
twisted-19.7.0
twisted-20.*
twisted-20.11.0.dev6
twisted-21.*
twisted-21.2.0
twisted-21.2.0rc1
twisted-21.7.0
twisted-21.7.0rc1
twisted-21.7.0rc2
twisted-21.7.0rc3
twisted-22.*
twisted-22.1.0
twisted-22.1.0rc1
twisted-22.10.0
twisted-22.10.0rc1
twisted-22.2.0
twisted-22.2.0rc1
twisted-22.4.0
twisted-22.4.0rc1
twisted-22.8.0
twisted-22.8.0rc1
twisted-23.*
twisted-23.10.0rc1
twisted-23.8.0
twisted-23.8.0rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46137.json"