Resource exhaustion in Twisted Web - #VU159513
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote client to exhaust CPU resources in the Twisted Web HTTP/2 server and cause denial of service over a single connection. Sustained traffic can saturate a CPU core with only a small volume of network traffic. There is no confidentiality or integrity impact and no code execution.
The vulnerability exists due to ordered processing of HTTP/2 events that dispatches and synchronously renders a completed request before handling its subsequent stream reset, combined with the absence of limits on opened-and-reset streams. A remote attacker can connect to a Twisted HTTP/2 endpoint without credentials and repeatedly send a HEADERS frame with END_STREAM on a fresh stream identifier immediately followed by RST_STREAM. Each request is rendered before its reset is processed, and the reset frees the stream so it does not accumulate against the 100-stream concurrency budget. No reset-rate limiter throttles this pattern, allowing repeated request rendering at line rate without the connection being throttled or closed.
In src/twisted/web/_http2.py, H2Connection.dataReceived processes RequestReceived, StreamEnded, and StreamReset events in order for the paired frames. The _requestReceived handler allocates the request, _requestEnded invokes request completion and synchronous rendering, and _requestAborted subsequently frees the stream. Unlike clients that leave streams open and are disconnected upon reaching the concurrent-stream limit, rapidly reset streams permit work to grow with the number of frame pairs sent. This is an HTTP/2 Rapid Reset mechanism; limits on outbound control-frame buffering do not constrain this request-processing path.