CVE-2024-41671 HIGH

CVE-2024-41671: twisted.web has disordered HTTP pipeline response

Vendor Twisted

Product twisted

Weakness CWE-444

Published July 29, 2024

Last update November 3, 2025

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

Key dates

02Disclosure timeline

July 29, 2024 CVE published

November 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-41671 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/444.html

Related vulnerabilities

04Related CVE

CVE-2025-53643 AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections CVE-2024-35161 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling CVE-2026-32239 Cap'n Proto has an integer overflow in KJ-HTTP CVE-2021-21295 Possible request smuggling in HTTP/2 due missing validation CVE-2026-58055 nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length