Summary
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with END_STREAM and then immediately resets the stream makes the server route and render the request before it processes the reset. Reset streams are freed and never count against the concurrent-stream limit, and no reset-rate limiter exists, so the pattern can be repeated at line rate on one connection. This is the HTTP/2 Rapid Reset class, CVE-2023-44487.
Details
For one received segment the h2 events are processed in order in H2Connection.dataReceived. A HEADERS(END_STREAM) followed by RST_STREAM yields RequestReceived, StreamEnded, then StreamReset, so the request is dispatched and rendered on stream end before the reset is handled:
# src/twisted/web/_http2.py (H2Connection.dataReceived)
for event in events:
if isinstance(event, h2.events.RequestReceived):
self._requestReceived(event) # allocate the request
elif isinstance(event, h2.events.StreamEnded):
self._requestEnded(event) # -> requestComplete -> render() synchronously
elif isinstance(event, h2.events.StreamReset):
self._requestAborted(event) # processed last, frees the stream
_requestAborted frees the reset stream, so it never occupies the 100-stream concurrency budget, and nothing in _http2.py counts or throttles opened-and-reset streams. The 2019 flood fix (GHSA-32gv) bounds outbound control-frame buffering only and does not apply to this path.
Affected product: Twisted, twisted.web HTTP/2 server
Affected versions: confirmed against 26.4.0
PoC
On any Twisted HTTP/2 endpoint, open one connection and, in a tight loop, send a HEADERS frame with END_STREAM on a fresh stream identifier immediately followed by a RST_STREAM for that stream, at line rate. No credentials are required. The server renders each request on stream end before the reset frees the stream, and a freed stream never counts toward the concurrent-stream limit, so the loop is never throttled.
Because every cancelled stream is still dispatched in full and reset streams do not accumulate, the connection is never throttled or closed, so the forced work grows with the number of pairs sent. Sustained on one connection this saturates a CPU core under only a trickle of traffic, whereas a client that instead leaves its streams open is closed once it reaches the concurrent-stream limit.
Impact
This is an unauthenticated remote denial of service (CWE-400, CWE-770) by CPU exhaustion. One connection forces unbounded request rendering at a few frames per cancelled request, bypassing the concurrent-stream limit. It is the HTTP/2 Rapid Reset class (CVE-2023-44487), not covered by the earlier Twisted flood fix, with no confidentiality or integrity impact and no code execution.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
GHSA-VPP8-G58W-M8MP has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (26.10.0rc1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-VPP8-G58W-M8MP? GHSA-VPP8-G58W-M8MP is a high-severity uncontrolled resource consumption vulnerability in Twisted (pip), affecting versions <= 26.4.0. It is fixed in 26.10.0rc1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is GHSA-VPP8-G58W-M8MP? GHSA-VPP8-G58W-M8MP has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of Twisted are affected by GHSA-VPP8-G58W-M8MP? Twisted (pip) versions <= 26.4.0 is affected.
- Is there a fix for GHSA-VPP8-G58W-M8MP? Yes. GHSA-VPP8-G58W-M8MP is fixed in 26.10.0rc1. Upgrade to this version or later.
- Is GHSA-VPP8-G58W-M8MP exploitable, and should I be worried? Whether GHSA-VPP8-G58W-M8MP is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-VPP8-G58W-M8MP is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-VPP8-G58W-M8MP? Upgrade
Twistedto 26.10.0rc1 or later.