https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 20:41:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115775 <p>Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.</p> <p>Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115775 https://db.gcve.eu/vuln/ghsa-3476-c5c2-fr73 <p><strong>Affected:</strong> PyPI: Twisted</p> <p>## Summary</p> <p>An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.</p> <p>## Details</p> <p>In `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element&#39;s children and descends into it, with no depth or child-count check:</p> <p>```python # src/twisted/words/xish/domish.py (ExpatElementStream._onStartElement) if self.documentStarted == 1: if self.currElem != None: self.currElem.children.append(e) # append child: no depth/count cap e.parent = self.currElem self.currElem = e # descend into the new element ```</p> <p>An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport `XmlStream.dataReceived` feeds bytes to `self.stream.parse(data)` with no size limit, and in XMPP the stream is parsed during negotiation before authentication.</p> <p>Affected product: Twisted, `twisted.words.xish.domish` element stream Affected versions: confirmed against 26…</p> <p><strong>Affected:</strong> PyPI: Twisted</p> <p>## Summary</p> <p>An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote peer exhaust server memory over a single stream. When the peer opens a container element and streams child elements without ever closing the container, every element is materialised into an in-memory tree with no limit on depth or child count. An element is released only when its end tag arrives, so a container the attacker never closes retains everything beneath it until the process is killed.</p> <p>## Details</p> <p>In `ExpatElementStream._onStartElement`, each start tag appends a new element to the current element&#39;s children and descends into it, with no depth or child-count check:</p> <p>```python # src/twisted/words/xish/domish.py (ExpatElementStream._onStartElement) if self.documentStarted == 1: if self.currElem != None: self.currElem.children.append(e) # append child: no depth/count cap e.parent = self.currElem self.currElem = e # descend into the new element ```</p> <p>An element is emitted and dropped only when its end tag arrives while it sits directly under the document root, so a container that is never closed keeps every child beneath it. The transport `XmlStream.dataReceived` feeds bytes to `self.stream.parse(data)` with no size limit, and in XMPP the stream is parsed during negotiation before authentication.</p> <p>Affected product: Twisted, `twisted.words.xish.domish` element stream Affected versions: confirmed against 26…</p> https://db.gcve.eu/vuln/ghsa-3476-c5c2-fr73