Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 14 March 2022.

Which products and versions are affected?

twisted (PyPI) ECOSYSTEM:introduced=0,fixed=19.10.0.

Is there a fix for This vulnerability?

Yes. twisted (PyPI): upgrade to 19.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run twisted (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Twisted HTTP/2 denial of service via ping, reset, and settings floods

Severity: info · Published 2022-03-14

Twisted is a Python networking library widely used to build web servers and other network applications. When HTTP/2 support is enabled via optional dependencies, Twisted servers can be brought down through a denial-of-service attack using maliciously crafted ping, reset, or settings frame floods. An attacker on the network can exhaust server resources without authentication, making the application unavailable to legitimate users.

Technologies: twisted (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 14 March 2022.
Which products and versions are affected?: twisted (PyPI) ECOSYSTEM:introduced=0,fixed=19.10.0.
Is there a fix for This vulnerability?: Yes. twisted (PyPI): upgrade to 19.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run twisted (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

twisted (PyPI): upgrade to 19.10.0 or later
```
pip install "twisted>=19.10.0"
```

Technical details

The vulnerability encompasses three distinct HTTP/2 flow-control attacks (CVE-2019-9512 ping flood, CVE-2019-9514 reset flood, CVE-2019-9515 settings flood) affecting Twisted's optional HTTP/2 support. The root cause is insufficient protection against rapid, high-volume control frame transmission without proper rate limiting or buffering constraints. An unauthenticated network attacker can send malformed or excessive control frames to trigger resource exhaustion (CPU, memory, or connection handling capacity), causing denial of service. The fix, released in version 19.10.0, implements frame buffering and timeout mechanisms to mitigate these attacks.

Affected products

Twisted Twisted before 19.10.0

Timeline

2022-03-14: disclosed
2019-10: patched: Version 19.10.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.