CVE-2024-41671

What it actually does

The twisted.web HTTP 1.0/1.1 server processes pipelined requests out-of-order, allowing response content from one request to be returned in place of another and resulting in information disclosure.

Why it matters to the business

Applications built on Twisted may leak sensitive response data to clients that did not request it, increasing the risk of data exposure in production web services.

How an attack unfolds

An attacker sends multiple pipelined HTTP requests over a single connection; the server reorders processing so that responses are mismatched, causing one client's response data to be delivered to another client.

How to fix it

Upgrade Twisted to version 24.7.0rc1 or later; apply commit 4a930de12fb67e88fefcb8822104152f42b27abc in source builds.

How to confirm the fix worked

Verify the installed Twisted version is 24.7.0rc1 or newer; replay pipelined requests in a test environment and confirm responses are returned in the original request order.

Typical attack path

1. Establish a persistent HTTP connection to a Twisted web server
2. Issue multiple pipelined requests in quick succession
3. Receive responses that contain content intended for a different request
4. Extract sensitive information from the disclosed response bodies

How to detect it

Review web server access logs for high volumes of pipelined requests on the same connection and inspect application logs for mismatched request-response pairs or unexpected data leakage.

What your security team should do

• Upgrade all Twisted installations to the fixed version without delay
• Audit services that expose twisted.web to the network for exposure
• Add version pinning and automated dependency checks in build pipelines