cve/2024/CVE-2024-41671.md

### [CVE-2024-41671](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41671)
![](https://img.shields.io/static/v1?label=Product&message=twisted&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%3D%2024.3.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%3A%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20('HTTP%20Request%2FResponse%20Smuggling')&color=brighgreen)

### Description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

### POC

#### Reference
- https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7

#### Github
No PoCs found on GitHub currently.