Executive brief
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Affected products
- PyPI twisted
Junglewise Threat Intelligence
CVE-2019-12387: PYSEC-2019-128 - In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters s
CVE-2019-12387 · Severity: low · CVSS 3.1 · Published 2019-06-10
Technologies: twisted (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1992 - twisted.web has disordered HTTP pipeline response
- PYSEC-2026-1055 - Twisted vulnerable to NameVirtualHost Host header injection
- Twisted Denial of Service via DNS compression pointer chains
- PYSEC-2024-75 - Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains a
- PYSEC-2023-224 - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP p