peter bassill · operator
$ cve CVE-2020-10108 JSON

CVE-2020-10108

9.8
CRITICAL · CVSS 3.1 · EPSS 4% (pctl 90)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS3.97% — more likely to be exploited than 90% of all CVEs
WeaknessCWE-444
On CISA KEVno
Public exploitnone known
Published2020-03-12
Last modified2026-06-17

Affected (6)

VendorProduct
canonicalubuntu linux
debiandebian linux
fedoraprojectfedora
oraclesolaris
oraclezfs storage appliance kit
twistedtwisted

References

→ the Explorer  ·  watch your stack  ·  NVD