# CVE-2023-46137: python3-twisted: Twisted is an event-based framework for internet applications

CVE-2023-46137 is fixed in 4 products on 1 platform, first by python3-twisted 18.9.0-11ubuntu0.20.04.3, released October 25, 2023. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2023-46137
- Priority: Routine
- CVSS: 5.3 (Medium)
- EPSS: 0.0088
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 25, 2023

## Description

Twisted is an event-based framework for internet applications. Prior toversion 23.10.0rc1, when sending multiple HTTP requests in one TCP packet,twisted.web will process the requests asynchronously without guaranteeingthe response order. If one of the endpoints is controlled by an attacker,the attacker can delay the response on purpose to manipulate the responseof the second request when a victim launched two requests using HTTPpipeline. Version 23.10.0rc1 contains a patch for this issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python3-twisted Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.3 | [python3-twisted 18.9.0-11ubuntu0.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-twisted-18.9.0-11ubuntu0.20.04.3.md) | Oct 25, 2023 |
| Linux | python3-twisted Ubuntu 22.04.1 LTS (jammy) | 22.1.0-2ubuntu2.4 | [python3-twisted 22.1.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-twisted-22.1.0-2ubuntu2.4.md) | Oct 25, 2023 |
| Linux | python3-twisted Ubuntu 24.04.5 LTS (noble) | 22.4.0-4ubuntu1 | [python3-twisted 22.4.0-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-python3-twisted-22.4.0-4ubuntu1.md) | Oct 25, 2023 |
| Linux | python3-twisted Ubuntu 24.10 (oracular) | 22.4.0-4ubuntu1 | [python3-twisted 22.4.0-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-python3-twisted-22.4.0-4ubuntu1.md) | Jan 16, 2026 |
| Linux | python3-twisted Ubuntu 25.04 (plucky) | 22.4.0-4ubuntu1 | [python3-twisted 22.4.0-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-python3-twisted-22.4.0-4ubuntu1.md) | Jan 16, 2026 |
| Linux | python3-twisted amzn 2023 | 22.4.0-126.amzn2023.0.3 | [ALAS2023-2023-432](https://patchblox.com/security/data/fix/linux/alas2023-2023-432.md) | Nov 9, 2023 |
| Linux | python3-twisted+tls amzn 2023 | 22.4.0-126.amzn2023.0.3 | [ALAS2023-2023-432](https://patchblox.com/security/data/fix/linux/alas2023-2023-432.md) | Nov 9, 2023 |
| Linux | python3-twisted-bin Ubuntu 20.04 LTS (focal) | 18.9.0-11ubuntu0.20.04.3 | [python3-twisted-bin 18.9.0-11ubuntu0.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-twisted-bin-18.9.0-11ubuntu0.20.04.3.md) | Oct 25, 2023 |
| Linux | twisted Debian 12.15 (bookworm) | 22.4.0-4+deb12u1 | [DSA-5797-1](https://patchblox.com/security/data/fix/linux/dsa-5797-1.md) | Oct 25, 2024 |
| Linux | twisted Debian 13.5 (trixie) | 23.10.0-1 | [DEBIAN-CVE-2023-46137](https://patchblox.com/security/data/fix/linux/debian-cve-2023-46137.md) | Oct 25, 2023 |
| Linux | twisted Debian 14 | 23.10.0-1 | [DEBIAN-CVE-2023-46137](https://patchblox.com/security/data/fix/linux/debian-cve-2023-46137.md) | Oct 25, 2023 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.