CVE-2022-21716: Debian Linux

High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days.

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 35 only; version 36 only
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Twisted Twisted: from 21.7.0, before 22.2.0 (fixed in 22.2.0)

Published 2022-03-03. Last modified 2026-06-17.