{"id":"CVE-2022-39348","aliases":["GHSA-vg46-2rrj-3647","PYSEC-2026-1055"],"title":"Twisted vulnerable to NameVirtualHost Host header injection","summary":"Twisted vulnerable to NameVirtualHost Host header injection","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","vendor":"twisted","product":"twisted","ecosystem":"pip","affected":["twisted >= 0.9.4, < 22.10.0rc1"],"patched":["twisted 22.10.0rc1"],"published":"2022-10-26","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vg46-2rrj-3647","references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348"},{"url":"https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b"},{"url":"https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4"},{"url":"https://github.com/twisted/twisted"},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"},{"url":"https://security.gentoo.org/glsa/202301-02"}],"tags":["osv","pip"],"epss":0.01244,"epssPercentile":0.67945,"ingestedAt":"2026-07-08T18:25:53.322Z","slug":"CVE-2022-39348","body":"## Overview\n\nWhen the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.\n\nExample configuration:\n```python\nfrom twisted.web.server import Site\nfrom twisted.web.vhost import NameVirtualHost\nfrom twisted.internet import reactor\n\nresource = NameVirtualHost()\nsite = Site(resource)\nreactor.listenTCP(8080, site)\nreactor.run()\n```\nOutput:\n```\n❯ curl -H\"Host:
HELLO THERE
\" http://localhost:8080/\n\n\n 404 - No Such Resource\n \n
No Such Resource
\n
host b'
hello there
' not in vhost map\n \n\n```\n\nThis vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.\n\n## Affected packages\n\n- `twisted >= 0.9.4, < 22.10.0rc1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `twisted 22.10.0rc1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}