GHSA-vpp8-g58w-m8mp: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with END_STREAM and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487.
References
- github.com/advisories/GHSA-vpp8-g58w-m8mp
- github.com/twisted/twisted/commit/498939422b69d5a75c4b8f81fa7926423dac534d
- github.com/twisted/twisted/pull/12749
- github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
- github.com/twisted/twisted/security/advisories/GHSA-vpp8-g58w-m8mp
- nvd.nist.gov/vuln/detail/cve-2023-44487
Code Behaviors & Features
Detect and mitigate GHSA-vpp8-g58w-m8mp with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →