CVE-2023-46137

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

• CWE-444
• CWE-444

• https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wmExploit, Vendor Advisory
• https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wmExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html

Published

Oct 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46131Grails is a framework used to build web applications with th…7.5
• CVE-2023-46132Hyperledger Fabric is an open source permissioned distribute…6.5
• CVE-2023-46133CryptoES is a cryptography algorithms library compatible wit…9.1
• CVE-2023-46134D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2023-46135rs-stellar-strkey is a Rust lib for encode/decode of Stellar…7.5
• CVE-2023-46136Werkzeug is a comprehensive WSGI web application library. In…7.5
• CVE-2023-46138JumpServer is an open source bastion host and maintenance se…5.3
• CVE-2023-46139KernelSU is a Kernel based root solution for Android. Starti…5.7
• CVE-2023-4614This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2023-46141Incorrect Permission Assignment for Critical Resource vulner…9.8
• CVE-2023-46142A incorrect permission assignment for critical resource vuln…8.8
• CVE-2023-46143Download of Code Without Integrity Check vulnerability in PH…7.5