CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

• CWE-425

• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
• https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.htmlMailing List, Vendor Advisory
• https://twistedmatrix.com/trac/ticket/8623Patch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2016/07/18/6Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
• https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.htmlMailing List, Vendor Advisory
• https://twistedmatrix.com/trac/ticket/8623Patch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2016/07/18/6Mailing List, Third Party Advisory

Published

Mar 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1000105Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1000106Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1000107inets in Erlang possibly 22.1 and earlier follows RFC 3875 s…6.1
• CVE-2016-1000108yaws before 2.0.4 does not attempt to address RFC 3875 secti…6.1
• CVE-2016-1000109HHVM does not attempt to address RFC 3875 section 4.1.18 nam…5.3
• CVE-2016-1000110The CGIHandler class in Python before 2.7.12 does not protec…6.1
• CVE-2016-1000112Unauthenticated remote .jpg file upload in contus-video-comm…9.1
• CVE-2016-1000113XSS and SQLi in huge IT gallery v1.1.5 for Joomla9.8
• CVE-2016-1000114XSS in huge IT gallery v1.1.5 for Joomla6.1
• CVE-2016-1000115Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and X…
• CVE-2016-1000116Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and X…
• CVE-2016-1000117XSS & SQLi in HugeIT slideshow v1.0.4