Zero Radar
← feed
HighVulnerabilityGHSA-vpp8-g58w-m8mpupdated 29 Oct 2026, 16:41 UTC

Twisted HTTP/2 server can be overloaded by one client using rapid stream resets

A remote client can open one connection and repeatedly send requests it immediately cancels, forcing the server to do full work for each and using up its CPU. This can make the server slow or unresponsive for everyone.

Fixed in Twisted 26.10.0rc1Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesTwisted 26.10.0rc1 · since 29 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker opens connectionOne connection, no login needed
  2. 2Sends request then resetHEADERS with END_STREAM, then RST_STREAM
  3. 3Server renders requestWork done before reset is processed
  4. 4Reset frees streamFreed streams never count toward limit
  5. 5CPU saturatedRepeated at line rate, never throttled
  6. ResultServer CPU exhausted, service denied

What happened

In the Twisted web HTTP/2 server, a request whose header block carries END_STREAM is routed and rendered before a following RST_STREAM is processed. Reset streams are freed without counting against the concurrent-stream limit, and there is no reset-rate limiter, so this can be repeated at high rate on a single connection (CWE-400, same class as CVE-2023-44487).

Why it is dangerous: An unauthenticated attacker can exhaust server CPU with little traffic, causing denial of service. Anyone running a Twisted HTTP/2 web endpoint exposed to untrusted clients is at risk.

Are you affected?

You are affected if you run Twisted 26.4.0 or earlier with its twisted.web HTTP/2 server exposed to clients.

Package / productAffected versionsFixed in
Twisted · pip<= 26.4.026.10.0rc1

What to do

  1. Upgrade Twisted to 26.10.0rc1 or later
  2. If you cannot upgrade yet, restrict HTTP/2 access to trusted clients or place a reverse proxy with rate limits in front of the server
  3. Monitor server CPU usage for sudden spikes from single connections

Timeline

  1. 29 Oct 2026, 16:41 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:41 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 29 Oct 2026, 16:41 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-vpp8-g58w-m8mp
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 16:41 UTC
On Zero Radar
29 Oct 2026, 16:41 UTC (0 min after disclosure)
Last change
29 Oct 2026, 16:41 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Twisted HTTP/2 server can be overloaded by one client using rapid stream resets · Zero Radar