CVE-2026-115776

In Twisted before 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet with the correct transaction ID can inject a forged answer.

In Twisted prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

In Twisted before 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches parseNestedParens with a negative literal size in an authenticated SEARCH command after the client selects a mailbox. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating, freezing the single-threaded reactor.

In Twisted 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py passes characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing catastrophic backtracking. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output.