{"id":"CVE-2026-115776","aliases":["AZL-111410","BELL-CVE-2026-115776","CLSA-2026-1793013013","DEBIAN-CVE-2026-115776","EUVD-2026-109150","GHSA-53xc-49m8-p798","UBUNTU-CVE-2026-115776","openSUSE-SU-2026:12381-1"],"status":"published","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00501,"percentile":0.43386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-10-23T20:18:38Z","modified":"2026-11-11T07:30:05Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["26.10.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-twisted","fixed_in":["26.10.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["26.10.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"26.4.0"},{"fixed":"26.10.0rc1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.10.0-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.10.0-r0"},{"fixed":"26.10.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.3.0"},{"fixed":"20.3.0.post7+tuxcare"}]}],"versions":["20.3.0","20.3.0.post4+tuxcare","20.3.0.post5+tuxcare","20.3.0.post6+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.4.0-4","22.4.0-4+deb12u1","23.10.0-1","23.10.0-2","24.10.0-1","24.10.0-2","24.11.0-1","24.3.0-1","24.3.0-2","24.3.0-3","24.7.0-1","24.7.0-2","24.7.0-3","25.5.0-1","25.5.0-2","25.5.0-3","25.5.0-4","25.5.0-5","26.10.0-1","26.4.0-1","26.4.0-2","26.4.0-3","26.4.0-4","26.4.0-5","26.4.0-6"]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.11.0-1","25.5.0-1","25.5.0-2","25.5.0-3","25.5.0-4","25.5.0-5","26.10.0-1","26.4.0-1","26.4.0-2","26.4.0-3","26.4.0-4","26.4.0-5","26.4.0-6"]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.10.0-1"}]}],"versions":["24.11.0-1","25.5.0-1","25.5.0-2","25.5.0-3","25.5.0-4","25.5.0-5","26.4.0-1","26.4.0-2","26.4.0-3","26.4.0-4","26.4.0-5","26.4.0-6"]},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.10.0rc1"}]}],"versions":["1.0.1","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.2.0","10.0.0","10.1.0","10.2.0","11.0.0","11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","2.1.0","2.4.0","2.5.0","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0","22.1.0rc1","22.10.0","22.10.0rc1","22.2.0","22.2.0rc1","22.4.0","22.4.0rc1","22.8.0","22.8.0rc1","23.10.0","23.10.0rc1","23.8.0","23.8.0rc1","24.10.0","24.10.0rc1","24.11.0","24.11.0rc1","24.11.0rc2","24.2.0rc1","24.3.0","24.7.0","24.7.0rc1","24.7.0rc2","25.5.0","25.5.0rc1","26.4.0","26.4.0rc2","8.0.0","8.0.1","8.1.0","8.2.0","9.0.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2","13.2.0-1ubuntu1.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1","16.0.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1","17.9.0-2ubuntu0.3","17.9.0-2ubuntu0.3+esm1","17.9.0-2ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1","18.9.0-11ubuntu0.20.04.2","18.9.0-11ubuntu0.20.04.3","18.9.0-11ubuntu0.20.04.4","18.9.0-11ubuntu0.20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2","22.1.0-2ubuntu2.1","22.1.0-2ubuntu2.3","22.1.0-2ubuntu2.4","22.1.0-2ubuntu2.5","22.1.0-2ubuntu2.6","22.1.0-2ubuntu2.7","22.1.0-2ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.4.0-4","22.4.0-4ubuntu1","23.10.0-2","24.3.0-1","24.3.0-1ubuntu0.1","24.3.0-1ubuntu0.2","24.3.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.5.0-5","26.4.0-4","26.4.0-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.11.0-1","25.5.0-4","25.5.0-5","25.5.0-5ubuntu0.1","25.5.0-5ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.10.0-1.1"}]}],"bundled":4}],"products":[{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/twisted/twisted/pull/12771","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-53xc-49m8-p798"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115776","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-115776","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115776.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-115776","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-115776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115776","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83813","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-115776","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T20:18:38.342Z","modified":"2026-10-30T14:27:25.835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:20:01.618694Z"}],"euvd":[{"id":"EUVD-2026-109150","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T20:18:38Z","modified":"2026-10-30T14:27:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:06.607412Z"}],"ghsa":[{"id":"GHSA-53xc-49m8-p798","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","description":"## Summary\n\nAn unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.\n\n## Details\n\n`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:\n\n```python\n# twisted/words/protocols/irc.py\nclass IRC(protocol.Protocol):        # not a LineReceiver, so no MAX_LENGTH\n    buffer = \"\"\n    def dataReceived(self, data):\n        if isinstance(data, bytes):\n            data = data.decode(\"utf-8\")\n        lines = (self.buffer + data).split(LF)\n        self.buffer = lines.pop()    # no 3line feed -\u003e whole input stays buffered\n        ...\n```\n\nWith no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required.\n\nAffected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nOn a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.\n\nIn a measured run against a real `IRCFactory` server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.\n\n## Impact\n\nAn unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole `twistd words` process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.","status":"published","published":"2026-10-23T20:45:35Z","modified":"2026-10-23T20:45:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-115776","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T21:17:23.18Z","modified":"2026-10-30T15:16:45.59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:13:03.126833Z"}],"osv":[{"id":"BELL-CVE-2026-115776","status":"published","published":"2026-10-28T06:08:00.25606Z","modified":"2026-11-11T07:30:05.581415342Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T07:56:32.232974Z"},{"id":"CVE-2026-115776","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T20:18:38.342Z","modified":"2026-11-02T12:26:58.996226313Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:56.675758Z"},{"id":"DEBIAN-CVE-2026-115776","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T21:17:23.18Z","modified":"2026-11-02T12:03:13.066197735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-53xc-49m8-p798","title":"Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer","description":"## Summary\n\nAn unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.\n\n## Details\n\n`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:\n\n```python\n# twisted/words/protocols/irc.py\nclass IRC(protocol.Protocol):        # not a LineReceiver, so no MAX_LENGTH\n    buffer = \"\"\n    def dataReceived(self, data):\n        if isinstance(data, bytes):\n            data = data.decode(\"utf-8\")\n        lines = (self.buffer + data).split(LF)\n        self.buffer = lines.pop()    # no 3line feed -\u003e whole input stays buffered\n        ...\n```\n\nWith no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required.\n\nAffected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nOn a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.\n\nIn a measured run against a real `IRCFactory` server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.\n\n## Impact\n\nAn unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole `twistd words` process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.","status":"published","published":"2026-10-23T20:45:35Z","modified":"2026-10-23T21:00:06.139894246Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2026-115776","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T21:17:00Z","modified":"2026-11-05T11:46:54.72062893Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"AZL-111410","title":"CVE-2026-115776 affecting package python-twisted 22.10.0-7","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.","status":"published","published":"2026-10-23T21:17:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"CLSA-2026-1793013013","title":"TuxCare security update for twisted (4 CVEs)","description":"TuxCare rebuilt twisted to address 4 CVEs. Fixed in 20.3.0.post7+tuxcare.","status":"published","published":"2026-10-26T11:10:13Z","modified":"2026-10-26T13:30:16.425958341Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12381-1","title":"python-Twisted-doc-26.10.0-1.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-26.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-01T00:00:00Z","modified":"2026-11-02T12:15:05.672947054Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}