GHSA-8r99-h8j2-rw64 — twisted
Fix: twisted/twisted@20c787aGHSA-8r99-h8j2-rw64 is a security vulnerability in twisted. A fix is available for twisted — see the affected versions and patch details below.
Twisted vulnerable to HTTP Request Smuggling Attacks
Real-World Exposure
twistedReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Twisted Web is vulnerable to request smuggling attacks:
- "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security)
- " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security)
"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)closed in 9646- "Two CL header with different values is also not allowed." (ZeddYu Lu)
- "Only accept identity and chunked Transport-Encoding." (ZeddYu Lu)
Patches
https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081 https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281
Workarounds
N/A
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | twisted | all versions | 20.3.0pip install --upgrade 'twisted==20.3.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for twisted, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update twisted to 20.3.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8r99-h8j2-rw64 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-8r99-h8j2-rw64 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-8r99-h8j2-rw64. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-8r99-h8j2-rw64 in your dependencies?
O3 Security finds GHSA-8r99-h8j2-rw64 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.