CVE-2022-21712: Debian Linux

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 35 only; version 36 only
• Twisted Twisted: from 11.1.0, before 22.1.0 (fixed in 22.1.0)

Published 2022-02-07. Last modified 2026-06-17.