CVE-2023-46137 - CVE House
Back to Database
Status published Medium CVE-2023-46137

twisted.web has disordered HTTP pipeline response

Vulnerability Description

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46137

Credits & Attribution

No credits recorded in the NVD database.

References

More from twisted

View All →
CVE-2024-41810
HTML injection in HTTP redirect body
Medium 6.1
CVE-2024-41671
twisted.web has disordered HTTP pipeline response
High 8.3
CVE-2022-39348
Twisted vulnerable to NameVirtualHost Host header injection
Medium 5.4
CVE-2022-24801
HTTP Request Smuggling in twisted.web
High 8.1
CVE-2022-23607
Unsafe handling of user-specified cookies in treq
Medium 6.5

Affected Vendor

Affected Software

twisted
Vulnerable Versions:
23.10.0rc1

Timeline

Official Publish: October 25th, 2023
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion