CVE-2026-83813

CVE-2026-83813 · Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet to the resolver's listening port with the correct transaction ID can inject a forged answer. The standard twisted.names.client.Resolver uses a new random source port for each query, increasing off-path attack complexity, while applications that reuse a DNSDatagramProtocol instance expose only the transaction-ID search space after the first query. A successful forgery can redirect hostname resolution and enable mail interception, server-side request forgery, or man-in-the-middle positioning. This issue is fixed in version 26.10.0rc1.

CVSS 3.1 · Baja · EPSS 0,1%

Publicación

2026-10-23T20:21:54.364Z

Actualización

2026-10-23T20:21:54.364Z

Pila tecnológica: system

Comprueba tu servidor →