CVE-2026-115778

In Twisted before 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet with the correct transaction ID can inject a forged answer.

In Twisted prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

In Twisted before 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches parseNestedParens with a negative literal size in an authenticated SEARCH command after the client selects a mailbox. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating, freezing the single-threaded reactor.

In Twisted 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py passes characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing catastrophic backtracking. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output.