In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109
Reference (s):
- FEDORA:FEDORA-2020-16dc0da400
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/
- FEDORA:FEDORA-2020-2136b020f2
- URL: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/
- GENTOO:GLSA-202007-24