CRITICAL 9.8 Microsoft

CVE-2020-10109

In Twisted Web through 19.10.0 there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Microsoft Security Update 2020-Mar: In Twisted Web through 19.10.0 there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Affected Products

References

Published: 2020-03-10 · Source: Microsoft · Feed updated: 2026-10-24
This critical severity vulnerability with a CVSS score of 9.8 was published on 2020-03-10 via Microsoft. Affected: cm1 python-twisted 20.3.0-1 on CBL Mariner 1.0, cbl2 python-twisted 22.2.0-1 on CBL Mariner 2.0.

Risk Timeline

CVE Disclosed2020-03-10 · 2418 days ago

Remediation Resources

Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2020-10109
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2020-10109

Related Vulnerabilities

CVETitleSeverityCVSS
CVE-2020-10108In Twisted Web through 19.10.0 there was an HTTP request splitting vulnerabilityCRITICAL9.8
CVE-2020-7009Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a HIGH8.8
CVE-2020-1712A heap use-after-free vulnerability was found in systemd before version v245-rc1HIGH7.8
CVE-2020-5291Privilege escalation in setuid mode via user namespaces in BubblewrapHIGH7.8
CVE-2020-1720A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION" where sub-commMEDIUM6.5
CVE-2020-10029The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buMEDIUM5.5
vulnfeed aggregates 15883 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.