CVE-2020-10109: python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding header

Severity: Critical

CVSS Score: 9.8

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.