Executive brief
Twisted is a Python networking library widely used to build web servers and other network applications. When HTTP/2 support is enabled via optional dependencies, Twisted servers can be brought down through a denial-of-service attack using maliciously crafted ping, reset, or settings frame floods. An attacker on the network can exhaust server resources without authentication, making the application unavailable to legitimate users.
Technical details
The vulnerability encompasses three distinct HTTP/2 flow-control attacks (CVE-2019-9512 ping flood, CVE-2019-9514 reset flood, CVE-2019-9515 settings flood) affecting Twisted's optional HTTP/2 support. The root cause is insufficient protection against rapid, high-volume control frame transmission without proper rate limiting or buffering constraints. An unauthenticated network attacker can send malformed or excessive control frames to trigger resource exhaustion (CPU, memory, or connection handling capacity), causing denial of service. The fix, released in version 19.10.0, implements frame buffering and timeout mechanisms to mitigate these attacks.
Affected products
- Twisted Twisted before 19.10.0
Timeline
- 2022-03-14: disclosed
- 2019-10: patched: Version 19.10.0 released