{"id":"CVE-2026-83813","title":"twisted: twisted: DNS spoofing via missing response source verification (CVE-2026-83813)","summary":"A flaw was found in Twisted. This vulnerability allows a network attacker to spoof Domain Name System (DNS) responses and redirect network traffic. The DNS protocol implementation accepts incoming User Datagram Protocol (UDP) responses tha…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":"CWE-346","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["ansible_automation_platform 2","openstack_platform 16.2"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:05:32+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-83813.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-83813.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-83813"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560186"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-83813"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83813"},{"url":"https://github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac"},{"url":"https://github.com/twisted/twisted/pull/12700"},{"url":"https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r"}],"tags":["csaf","vex","red-hat","cve.org"],"scores":{"vendor":3.7,"cna":3.1},"ingestedAt":"2026-10-23T21:38:13.061Z","slug":"CVE-2026-83813","body":"## Overview\n\nA flaw was found in Twisted. This vulnerability allows a network attacker to spoof Domain Name System (DNS) responses and redirect network traffic. The DNS protocol implementation accepts incoming User Datagram Protocol (UDP) responses that match a pending query transaction identifier without validating that the packet originated from the queried server address and port. By delivering a packet with the correct transaction identifier to the listening resolver, an attacker can inject forged answers and manipulate hostname resolution.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 16.2 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-83813.json)\n\n**twisted: twisted: DNS spoofing via missing response source verification** — rated Low by Red Hat. Released 2026-10-23.\n\nAffected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenStack Platform 16.2\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenStack Platform 16.2\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228635,"id":"CVE-2026-83813","ts":1792844825870,"field":"cvss","old":"3.1","new":"3.7"}]}