https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:05:44.777471+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-05982 bdu:2022-05982 2026-10-03T07:05:45.161917+00:00 bdu:2022-05982 https://cve.radiocsirt.org/vuln/bell-cve-2022-21716 Withdrawn: BELL-CVE-2022-21716 — CVE-2022-21716 does not affect BellSoft software 2026-10-03T07:05:45.161959+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/brew-alot-cve-2022-21716 BREW-alot-CVE-2022-21716 — Twisted SSH client and server deny of service during SSH handshake. 2026-10-03T07:05:45.161978+00:00

Affected: Homebrew: alot

### Impact

The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.

A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 < /dev/zero`.

### Patches

The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1

A fix is available in Twisted 22.2.0.

### Workarounds

* Limit access to the SSH server only to trusted source IP addresses. * Connect over SSH only to trusted destination IP addresses.

### References

Reported at https://twistedmatrix.com/trac/ticket/10284 Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx

### For more information

Found by vin01

 https://cve.radiocsirt.org/vuln/cnvd-2022-19501 cnvd-2022-19501 2026-10-03T07:05:45.162022+00:00 cnvd-2022-19501 https://cve.radiocsirt.org/vuln/euvd-2026-232791 EUVD-2026-232791 2026-10-03T07:05:45.162036+00:00 EUVD-2026-232791 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21716 fkie_cve-2022-21716 2026-10-03T07:05:45.162047+00:00

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

 https://cve.radiocsirt.org/vuln/ghsa-rv6r-3f5q-9rgx GHSA-rv6r-3f5q-9rgx — Twisted SSH client and server deny of service during SSH handshake. 2026-10-03T07:05:45.162071+00:00

Affected: PyPI: twisted

### Impact

The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.

A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 < /dev/zero`.

### Patches

The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1

A fix is available in Twisted 22.2.0.

### Workarounds

* Limit access to the SSH server only to trusted source IP addresses. * Connect over SSH only to trusted destination IP addresses.

### References

Reported at https://twistedmatrix.com/trac/ticket/10284 Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx

### For more information

Found by vin01

 https://cve.radiocsirt.org/vuln/gsd-2022-21716 gsd-2022-21716 2026-10-03T07:05:45.162103+00:00 gsd-2022-21716 https://cve.radiocsirt.org/vuln/oesa-2023-1908 OESA-2023-1908 — python-twisted security update 2026-10-03T07:05:45.162115+00:00

Affected: openEuler:20.03-LTS-SP3: python-twisted

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following: Security Fix(es): twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712) Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer&apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 &lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716) Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web&apos;s HTTP 1.1 se…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11978-1 openSUSE-SU-2024:11978-1 — python-Twisted-doc-22.2.0-1.1 on GA media 2026-10-03T07:05:45.162154+00:00

python-Twisted-doc-22.2.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2022-160 PYSEC-2022-160 2026-10-03T07:05:45.162173+00:00

Affected: PyPI: twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

 https://cve.radiocsirt.org/vuln/rhsa-2022:0982 RHSA-2022:0982 — Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-twisted) security update 2026-10-03T07:05:45.162194+00:00

dev-python/twisted: secret exposure in cross-origin redirects python-twisted: SSH client and server denial of service during SSH handshake

 https://cve.radiocsirt.org/vuln/suse-su-2022:2070-1 SUSE-SU-2022:2070-1 — Security update for python-Twisted 2026-10-03T07:05:45.162212+00:00

Security update for python-Twisted

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21716 UBUNTU-CVE-2022-21716 2026-10-03T07:05:45.162227+00:00

Affected: Ubuntu:Pro:14.04:LTS: twisted, Ubuntu:Pro:16.04:LTS: twisted, Ubuntu:18.04:LTS: twisted, Ubuntu:20.04:LTS: twisted, Ubuntu:22.04:LTS: twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0250 WID-SEC-W-2022-0250 — Red Hat OpenStack: Mehrere Schwachstellen 2026-10-03T07:05:45.162253+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenStack ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.