# CVE-2022-21716: twisted: Twisted is an event-based framework for internet applications, supporting Python 3.6+ CVE-2022-21716 is fixed in 14 products on 1 platform, first by python-twisted 17.9.0-2ubuntu0.3, released March 3, 2022. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2022-21716 - Priority: High - CVSS: 7.5 (high) - EPSS: 0.0351 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 3, 2022 ## Description Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | python-twisted Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-bin Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-bin 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-bin-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-conch Ubuntu 18.04.6 LTS (bionic) | 1:17.9.0-2ubuntu0.3 | [python-twisted-conch 1:17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-conch-1-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-core Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-core 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-core-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-mail Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-mail 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-mail-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-names Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-names 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-names-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-news Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-news 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-news-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-runner Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-runner 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-runner-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-web Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-web 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-web-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python-twisted-words Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python-twisted-words 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python-twisted-words-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python3-twisted Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python3-twisted 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-twisted-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python3-twisted Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.2 | [python3-twisted 18.9.0-11ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-twisted-18.9.0-11ubuntu0.20.04.2.md) | Mar 3, 2022 | | Linux | python3-twisted Ubuntu 22.04.1 LTS (jammy) | 22.1.0-2ubuntu2.1 | [python3-twisted 22.1.0-2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-twisted-22.1.0-2ubuntu2.1.md) | Mar 3, 2022 | | Linux | python3-twisted amzn 2023 | 22.4.0-124.amzn2023.0.2 | [ALAS2023-2023-056](https://patchblox.com/security/data/fix/linux/alas2023-2023-056.md) | Feb 17, 2023 | | Linux | python3-twisted+tls amzn 2023 | 22.4.0-124.amzn2023.0.2 | [ALAS2023-2023-056](https://patchblox.com/security/data/fix/linux/alas2023-2023-056.md) | Feb 17, 2023 | | Linux | python3-twisted-bin Ubuntu 18.04.6 LTS (bionic) | 17.9.0-2ubuntu0.3 | [python3-twisted-bin 17.9.0-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-python3-twisted-bin-17.9.0-2ubuntu0.3.md) | Mar 3, 2022 | | Linux | python3-twisted-bin Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.2 | [python3-twisted-bin 18.9.0-11ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-twisted-bin-18.9.0-11ubuntu0.20.04.2.md) | Mar 3, 2022 | | Linux | twisted Debian 12.15 (bookworm) | 22.2.0-1 | [DEBIAN-CVE-2022-21716](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21716.md) | Mar 3, 2022 | | Linux | twisted Debian 13.5 (trixie) | 22.2.0-1 | [DEBIAN-CVE-2022-21716](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21716.md) | Mar 3, 2022 | | Linux | twisted Debian 14 | 22.2.0-1 | [DEBIAN-CVE-2022-21716](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21716.md) | Mar 3, 2022 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.