Twisted HTTP/2 server 'Rapid Reset' DoS (GHSA-vpp8-g58w-m8mp): one unauthenticated client can exhaust CPU over a single connection. Which Twisted version fixes it and how do I mitigate before upgrading?

What it is: Twisted's HTTP/2 server handled a request that a client opened and immediately reset in the wrong order: it routed and rendered the request first, and reset streams didn't count against the concurrent-stream limit, with no limit on how fast clients could reset. One client could repeat this at line rate over one connection and use up the server's CPU. This is the same HTTP/2 'Rapid Reset' attack class as CVE-2023-44487 that hit many web servers in 2023. Published October 29, 2026 (high); fixed in Twisted 26.10.0 (released first as 26.10.0rc1). Am I affected: - Twisted 26.4.0 or earlier (pip show twisted) serving HTTP/2 directly: twisted.web with TLS and HTTP/2 enabled (the h2 package installed, so ALPN negotiates h2). Frameworks built on twisted.web (for example some Klein, Scrapy-related or Buildbot setups) inherit it if they serve HTTP/2 to clients. - Not affected if Twisted only speaks HTTP/1.1, or sits behind a reverse proxy/CDN that terminates HTTP/2 and talks HTTP/1.1 to it. Fix: 1. Upgrade to Twisted 26.10.0 or later once the final release is available in your environment; the release candidate 26.10.0rc1 contains the fix if you need it sooner. 2. Until then, either turn off HTTP/2 on the Twisted server (uninstall the h2 extra or don't advertise h2 in ALPN), or put it behind a reverse proxy or CDN that already has Rapid Reset protections and forwards HTTP/1.1. 3. Watch for high CPU with many short-lived streams from few client connections. Verify: pip show twisted reports 26.10.0+ (or rc1), or curl --http2 -sI https://your-host/ shows HTTP/1.1 if you disabled HTTP/2 there. Sources: https://github.com/twisted/twisted/security/advisories/GHSA-vpp8-g58w-m8mp https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1 https://nvd.nist.gov/vuln/detail/cve-2023-44487