Twisted vulnerabilities
CVEs whose affected-version data names the Twisted package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
10 CVEsRSS
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but d…
CVE-2026-115877Medium· 5.4Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
CVE-2026-115774Medium· 4.9Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-115775High· 8.7Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
CVE-2026-115778High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC…
CVE-2026-115776High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
CVE-2026-106454Medium· 4.3PoCTwisted is an event-based framework for internet applications, supporting Python 3.6+
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters …
CVE-2026-42304High· 7.5Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2024-41671High· 8.3twisted.web has disordered HTTP pipeline response
twisted.web has disordered HTTP pipeline response
CVE-2022-39348Medium· 5.4Twisted vulnerable to NameVirtualHost Host header injection
Twisted vulnerable to NameVirtualHost Host header injection