CVE-2026-115776highCWE-400CWE-770

CVE-2026-115776: fallo de gravedad alta en twisted

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear twisted+ Monitorear twisted

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.5%
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
twisted · twisted
CVEs relacionadas — twisted

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-21716HIGHBuffer Overflow in TwistedEPSS 3.5%CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.6%CVE-2022-21712HIGHCookie and header exposure in twistedEPSS 1.4%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2023-46137MEDIUMtwisted.web has disordered HTTP pipeline responseEPSS 0.9%