Twisted has 10 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 7 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 7. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-400 (4) and CWE-770 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 7 prev 1
Weakness classes
Products
- twisted 10
Worst active — by depth score
CVE-2026-115775High· 8.7Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree48CVE-2024-41671High· 8.3twisted.web has disordered HTTP pipeline response46CVE-2026-115778High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer41CVE-2026-115776High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer41CVE-2026-42304High· 7.5Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains41
Twisted vulnerabilities
CVEs affecting Twisted, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-83813Low· 3.1Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but d…
CVE-2026-115877Medium· 5.4Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
CVE-2026-115774Medium· 4.9Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
CVE-2026-115775High· 8.7Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
CVE-2026-115778High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC…
CVE-2026-115776High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
CVE-2026-106454Medium· 4.3PoCTwisted is an event-based framework for internet applications, supporting Python 3.6+
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters …
CVE-2026-42304High· 7.5Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2024-41671High· 8.3twisted.web has disordered HTTP pipeline response
twisted.web has disordered HTTP pipeline response
CVE-2022-39348Medium· 5.4Twisted vulnerable to NameVirtualHost Host header injection
Twisted vulnerable to NameVirtualHost Host header injection