Vulnerabilities

Vulnerability · GHSA-vpp8-g58w-m8mp

Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

Published Oct 29, 2026 · catalog updated Oct 29, 2026 · Twisted: Unauthenticated Remote Denial

Last checked Oct 30, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-vpp8-g58w-m8mp. A missing EPSS score is not a low risk. Compare Twisted: Unauthenticated Remote Denial with the linked advisory before you change production.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

PyPI twisted · pip Twisted

## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487. ## Details For one received segment the h2 events are processed in order in . A followed by yields , , then , so the request is dispatched and rendered on stream end before the reset is handled: frees the reset stream, so it never occupies the 100-stream concurrency budget, and nothing in counts or throttles opened-and-reset streams. The 2019 flood fix (GHSA-32gv) bounds outbound control-frame buffering only and does not apply to this path. Affected product: Twisted, HTTP/2 server Affected versions: confirmed against 26.4.0 ## PoC On any Twisted HTTP/2 endpoint, open one connection and, in a tight loop, send a frame with on a fresh stream identifier immediately followed by a for that stream, at line rate. No credentials are required. The server renders each request on stream end before the reset frees the stream, and a freed stream never counts toward the concurrent-stream limit, so the loop is never throttled. Because every cancelled stream is still dispatched in full and reset streams do not accumulate, the connection is never throttled or closed, so the forced work grows with the number of pairs sent. Sustained on one connection this saturates a CPU core under only a trickle of traffic, whereas a client that instead leaves its streams open is closed once it reaches the concurrent-stream limit. ## Impact This is an unauthenticated remote denial of service (CWE-400, CWE-770) by CPU exhaustion. One c