CVE-2024-41671 describes a vulnerability in the twisted.web HTTP server component used by Scrapy where HTTP pipelined requests can be processed and responded to out-of-order. This disordered HTTP pipeline response can cause information disclosure, particularly in scenarios where twisted.web servers are behind reverse proxies implementing connection pooling, potentially allowing remote attackers to receive responses intended for other clients. The vulnerability affects Scrapy versions >=2.9.0 and <2.11.2_3. A proof-of-concept demonstrates sending pipelined POST and GET requests resulting in out-of-order responses. The CVSS 3.1 score is 8.3 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and impacts on confidentiality, integrity, and availability.

The vulnerability can lead to information disclosure by allowing remote attackers to receive HTTP responses intended for other clients when twisted.web servers are used behind reverse proxies with connection pooling. This can compromise confidentiality and integrity of data served by the affected HTTP server. The issue also impacts availability due to the potential disruption caused by out-of-order responses.

A patch is available for this vulnerability. Users should upgrade Scrapy to version 2.11.2_3 or later where the issue is fixed. Until patched, avoid deploying twisted.web HTTP servers behind reverse proxies that use connection pooling to reduce the risk of information leakage. Check the official Twisted security advisory GHSA-xc8x-vp79-p3wm for detailed remediation instructions.