CVE-2022-21716

    Dashboard / Vulnerabilities / CVE-2022-21716

    CVE-2022-21716

    Published: 3 Mar 2022Last Modified: 12 Aug 2026

    Summary: Buffer Overflow in Twisted

    Details: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

    References: https://github.com/twisted/twisted/releases/tag/twisted-22.2.0, https://twistedmatrix.com/trac/ticket/10284, https://www.oracle.com/security-alerts/cpuapr2022.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21716.json, https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/, https://nvd.nist.gov/vuln/detail/CVE-2022-21716, https://security.gentoo.org/glsa/202301-02, https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9, https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4e3b22afe1f76b360733b65d6b835b7aaae6deb6
    Fixed -89c395ee794e85a9657b112c4351417850330ef9

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-21716 | CVE-DB