CVE-2026-106454: medium-severity vulnerability in twisted
Twisted: IMAP wildcardToRegexp() ReDoS
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
twisted · twistedRelated CVEs — twisted
In the same product, most dangerous first.
CVE-2022-21716HIGHBuffer Overflow in TwistedEPSS 3.5%CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-21712HIGHCookie and header exposure in twistedEPSS 1.4%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.3%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2026-42304HIGHTwisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer ChainsEPSS 0.9%