{"id":"CVE-2022-39348","aliases":["GHSA-vg46-2rrj-3647","PYSEC-2026-1055"],"url":"https://o3.security/vulnerability/CVE-2022-39348","summary":"Twisted vulnerable to NameVirtualHost Host header injection","details":"When the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.\n\nExample configuration:\n```python\nfrom twisted.web.server import Site\nfrom twisted.web.vhost import NameVirtualHost\nfrom twisted.internet import reactor\n\nresource = NameVirtualHost()\nsite = Site(resource)\nreactor.listenTCP(8080, site)\nreactor.run()\n```\nOutput:\n```\n❯ curl -H\"Host:
HELLO THERE
\" http://localhost:8080/\n\n\n 404 - No Such Resource\n \n
No Such Resource
\n
host b'
hello there
' not in vhost map\n \n\n```\n\nThis vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.","published":"2022-10-26T00:00:00Z","modified":"2026-08-12T03:51:49.335291432Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"twisted","fixedVersion":"22.10.0rc1"}],"fix":{"url":"https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b","label":"twisted/twisted@f2f5e81"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39348.json"},{"type":"ADVISORY","url":"https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202301-02"},{"type":"FIX","url":"https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b"},{"type":"FIX","url":"https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.335291432Z"}}