CVE-2024-41671: Twisted Web Information Disclosure Flaw

CVE-2024-41671 Overview

CVE-2024-41671 is an HTTP request smuggling vulnerability in Twisted, an event-based framework for internet applications supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web processes pipelined HTTP requests out-of-order. This behavior can result in information disclosure when responses from one client are returned to another. The flaw is categorized as Inconsistent Interpretation of HTTP Requests [CWE-444]. Twisted has remediated the issue in release 24.7.0rc1.

Critical Impact
Attackers on the network can exploit pipelined HTTP request handling to receive responses intended for other clients, leading to information disclosure across confidentiality, integrity, and availability boundaries.

Affected Products

Twisted framework versions prior to 24.7.0rc1
twisted.web HTTP 1.0 and HTTP 1.1 server components
Debian LTS distributions packaging affected Twisted versions

Discovery Timeline

2024-07-29 - CVE-2024-41671 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-41671

Vulnerability Analysis

The vulnerability resides in the HTTP server implementation within twisted.web. When clients send pipelined HTTP requests over a single connection, the server processes them concurrently rather than enforcing strict request-response ordering. HTTP pipelining requires that responses be returned in the exact order requests were received, per RFC 7230. Twisted's deviation from this requirement causes response payloads to be paired with the wrong request, exposing data intended for other clients sharing intermediate infrastructure such as load balancers or reverse proxies.

The condition is classified under [CWE-444] as Inconsistent Interpretation of HTTP Requests, commonly known as HTTP request smuggling. The flaw is network-exploitable without authentication or user interaction.

Root Cause

The root cause is the absence of serialization between pipelined HTTP request handlers in twisted.web. Concurrent processing produces out-of-order response delivery on the same TCP connection. A secondary issue addressed in the same release involves trailer header size accounting in chunked transfer decoding, where the boundary check did not account for partial line terminators in the buffer.

Attack Vector

An attacker establishes an HTTP connection to a Twisted-backed service and submits multiple pipelined requests. When the server processes them out-of-order, responses can be delivered to the wrong requesting party, particularly through shared front-end proxies. The attacker observes cross-tenant or cross-session response data without needing authentication.

python

# Patch in src/twisted/web/http.py - corrected trailer size enforcement
#        if (
#            self._receivedTrailerHeadersSize + len(self._buffer)
#            > self._maxTrailerHeadersSize
#        ):
#            raise _MalformedChunkedDataError("Trailer headers data is too long.")
#
        eolIndex = self._buffer.find(b"\r\n", self._start)

        if eolIndex == -1:
            # Still no end of network line marker found.
            #
            # Check if we've run up against the trailer size limit: if the next
            # read contains the terminating CRLF then we'll have this many bytes
            # of trailers (including the CRLFs).
            minTrailerSize = (
                self._receivedTrailerHeadersSize
                + len(self._buffer)
                + (1 if self._buffer.endswith(b"\r") else 2)
            )
            if minTrailerSize > self._maxTrailerHeadersSize:
                raise _MalformedChunkedDataError("Trailer headers data is too long.")
            # Continue processing more data.
            return False

Source: Twisted Commit Fix

Detection Methods for CVE-2024-41671

Indicators of Compromise

Anomalous pairing of HTTP responses with unrelated request URIs observed in proxy or application logs.
Multiple pipelined HTTP requests originating from a single client IP within a short window targeting twisted.web services.
Unexpected cross-session content appearing in client-side responses or error reports.

Detection Strategies

Inventory Python services and identify dependencies on Twisted versions earlier than 24.7.0rc1 through software composition analysis.
Inspect HTTP traffic at reverse proxies for pipelined request patterns combined with mismatched Content-Length or response body identifiers.
Apply [CWE-444] detection signatures focused on request smuggling at web application firewalls.

Monitoring Recommendations

Log full HTTP request and response correlation IDs at the application tier to surface ordering anomalies.
Monitor connection reuse statistics on Twisted-backed services and alert when pipelined requests exceed baseline volumes.
Track outbound responses for sensitive data fields delivered to clients that did not request them.

How to Mitigate CVE-2024-41671

Immediate Actions Required

Upgrade Twisted to version 24.7.0rc1 or later in all production and development environments.
Apply distribution patches such as the Debian LTS update for affected systems.
Audit downstream applications and frameworks that bundle Twisted as a transitive dependency.

Patch Information

The Twisted project remediated the vulnerability in release 24.7.0rc1. Fix commits are available at the Twisted Commit Update and Twisted Commit Fix. Additional details are published in the GitHub Security Advisory and the Debian LTS Announcement.

Workarounds

Disable HTTP keep-alive on the Twisted server to prevent request pipelining over reused connections.
Front Twisted services with a hardened reverse proxy such as NGINX configured to terminate and re-serialize HTTP requests.
Restrict service exposure to trusted networks until patching is complete.

bash

# Upgrade Twisted to the patched release
pip install --upgrade "Twisted>=24.7.0rc1"

# Verify the installed version
python -c "import twisted; print(twisted.__version__)"