p PatchFirst

CVE-2026-115778

CVE-2026-115778 · Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

CVSS 7.5 · High · EPSS 0.7% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • twisted

    Versions
    • < 26.10.0rc1: Affected

    No fix published

  • twisted Debian:12

    Versions
    • 22.4.0-4
    • 22.4.0-4+deb12u1
    • 23.10.0-1
    • 23.10.0-2
    • 24.10.0-1
    • 24.10.0-2
    • 24.11.0-1
    • 24.3.0-1
    • 24.3.0-2
    • 24.3.0-3
    • 24.7.0-1
    • 24.7.0-2
    • 24.7.0-3
    • 25.5.0-1
    • 25.5.0-2
    • 25.5.0-3
    • 25.5.0-4
    • 25.5.0-5
    • 26.4.0-1
    • 26.4.0-2
    • 26.4.0-3
    • 26.4.0-4
    • 26.4.0-5
    • 26.4.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twisted Debian:13

    Versions
    • 24.11.0-1
    • 25.5.0-1
    • 25.5.0-2
    • 25.5.0-3
    • 25.5.0-4
    • 25.5.0-5
    • 26.4.0-1
    • 26.4.0-2
    • 26.4.0-3
    • 26.4.0-4
    • 26.4.0-5
    • 26.4.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twisted Debian:14

    Versions
    • 24.11.0-1
    • 25.5.0-1
    • 25.5.0-2
    • 25.5.0-3
    • 25.5.0-4
    • 25.5.0-5
    • 26.4.0-1
    • 26.4.0-2
    • 26.4.0-3
    • 26.4.0-4
    • 26.4.0-5
    • 26.4.0-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twisted PyPI

    Versions
    • 1.0.1
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 10.0.0
    • 10.1.0
    • 10.2.0
    • 11.0.0
    • 11.1.0
    • 12.0.0
    • 12.1.0
    • 12.2.0
    • 12.3.0
    • 13.0.0
    • 13.1.0
    • 13.2.0
    • 14.0.0
    • 14.0.1
    • 14.0.2
    • 15.0.0
    • 15.1.0
    • 15.2.0
    • 15.2.1
    • 15.3.0
    • 15.4.0
    • 15.5.0
    • 16.0.0
    • 16.1.0
    • 16.1.1
    • 16.2.0
    • 16.3.0
    • 16.3.1
    • 16.3.2
    • 16.4.0
    • 16.4.1
    • 16.5.0
    • 16.5.0rc1
    • 16.5.0rc2
    • 16.6.0
    • 16.6.0rc1
    • 16.7.0rc1
    • 16.7.0rc2
    • 17.1.0
    • 17.1.0rc1
    • 17.5.0
    • 17.9.0
    • 17.9.0rc1
    • 18.4.0
    • 18.4.0rc1
    • 18.7.0
    • 18.7.0rc1
    • 18.7.0rc2
    • 18.9.0
    • 18.9.0rc1
    • 19.10.0
    • 19.10.0rc1
    • 19.2.0
    • 19.2.0rc1
    • 19.2.0rc2
    • 19.2.1
    • 19.7.0
    • 19.7.0rc1
    • 2.1.0
    • 2.4.0
    • 2.5.0
    • 20.3.0
    • 20.3.0rc1
    • 21.2.0
    • 21.2.0rc1
    • 21.7.0
    • 21.7.0rc1
    • 21.7.0rc2
    • 21.7.0rc3
    • 22.1.0
    • 22.1.0rc1
    • 22.10.0
    • 22.10.0rc1
    • 22.2.0
    • 22.2.0rc1
    • 22.4.0
    • 22.4.0rc1
    • 22.8.0
    • 22.8.0rc1
    • 23.10.0
    • 23.10.0rc1
    • 23.8.0
    • 23.8.0rc1
    • 24.10.0
    • 24.10.0rc1
    • 24.11.0
    • 24.11.0rc1
    • 24.11.0rc2
    • 24.2.0rc1
    • 24.3.0
    • 24.7.0
    • 24.7.0rc1
    • 24.7.0rc2
    • 25.5.0
    • 25.5.0rc1
    • 26.4.0
    • 26.4.0rc2
    • 8.0.0
    • 8.0.1
    • 8.1.0
    • 8.2.0
    • 9.0.0
    Affected ranges
    • ECOSYSTEM: < 26.10.0rc1

    Update to 26.10.0rc1

Original sources

Check your server →