Homepage

Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package python-twisted.src  (opens in a new tab)

Threat Intelligence

EPSS
1.24% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHONTWISTEDSRC-12614381
  • published11 Sept 2025
  • disclosed3 Mar 2022
Report a new vulnerability Found a mistake?

Introduced: 3 Mar 2022

CVE-2022-21716  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-twisted.src package and not the python-twisted.src package as distributed by RHEL.

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as nc -rv localhost 22 < /dev/zero. A patch is available in version 22.2.0. There are currently no known workarounds.

References