{"id":"GHSA-32gv-6cf3-wcmq","summary":"HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods","details":"### Impact\nTwisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:\n\nPing flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512\nReset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514\nSettings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515\n\nA Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).\n\n### Workarounds\nThere are no workarounds.\n\n### References\nhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)\n","modified":"2025-02-18T05:40:23.769200Z","published":"2022-03-14T22:45:11Z","database_specific":{"cwe_ids":[],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2022-03-14T22:45:11Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-32gv-6cf3-wcmq"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/a40ab1ce5210f231abe7a448a54d7e88e48f2d5d"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}],"affected":[{"package":{"name":"twisted","ecosystem":"PyPI","purl":"pkg:pypi/twisted"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-32gv-6cf3-wcmq/GHSA-32gv-6cf3-wcmq.json"}}],"schema_version":"1.9.0"}