CVE-2026-115778High· 7.5▾ TwilightTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.
twisted < 26.10.0rc1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Twisted <= 26.4.0Patched in:
Twisted 26.10.0rc1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115775High· 8.7Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
CVE-2026-115776High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
CVE-2026-115774Medium· 4.9Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-115877Medium· 5.4Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
CVE-2026-106454Medium· 4.3Twisted is an event-based framework for internet applications, supporting Python 3.6+