CVE-2022-24801

A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTTP parsers. This flaw allows a remote attacker to perform an HTTP request smuggling attack.

Red Hat Enterprise Linux 6 was affected but Out of Support Cycle because python-twisted was not listed in Red Hat Enterprise Linux 6 ELS Inclusion List. https://access.redhat.com/articles/4997301

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Filter malformed requests like '+ or -' in Content-Length header, Illegal characters like LF(\n) and HTAB(\t), and 0x prefixes in HTTP Headers.