Vulnerability-Lookup

CVE-2026-115776 (GCVE-0-2026-115776)

Vulnerability from cvelistv5 – Published: 2026-10-23 20:18 – Updated: 2026-10-23 20:18

Title

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Summary

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/twisted/twisted/security/advis…	x_refsource_CONFIRM
https://github.com/twisted/twisted/pull/12771	x_refsource_MISC
https://github.com/twisted/twisted/commit/01f8cff…	x_refsource_MISC
https://github.com/twisted/twisted/commit/ac90fb7…	x_refsource_MISC
https://github.com/twisted/twisted/releases/tag/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
twisted	twisted	Affected: < 26.10.0rc1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "twisted",
          "vendor": "twisted",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.10.0rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T20:18:38.342Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798"
        },
        {
          "name": "https://github.com/twisted/twisted/pull/12771",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/pull/12771"
        },
        {
          "name": "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30"
        },
        {
          "name": "https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059"
        },
        {
          "name": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
        }
      ],
      "source": {
        "advisory": "GHSA-53xc-49m8-p798",
        "discovery": "UNKNOWN"
      },
      "title": "Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115776",
    "datePublished": "2026-10-23T20:18:38.342Z",
    "dateReserved": "2026-10-23T13:28:51.847Z",
    "dateUpdated": "2026-10-23T20:18:38.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-115776",
      "date": "2026-10-25",
      "epss": "0.00501",
      "percentile": "0.42619"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "twisted",
                "vendor": "twisted",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 26.10.0rc1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1."
          }
        ],
        "id": "CVE-2026-115776",
        "lastModified": "2026-10-23T21:17:23.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T21:17:23.180",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/pull/12771"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-23T20:50:53+00:00",
      "cve": "CVE-2026-115776",
      "id": "CVE-2026-115776",
      "initial_release_date": "2026-10-23T20:18:38.342000+00:00",
      "product_status:known_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "twisted: Twisted: Denial of Service via unbounded IRC buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115776.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-115776

Vulnerability from fkie_nvd - Published: 2026-10-23 21:17 - Updated: 2026-10-23 21:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30
	security-advisories@github.com	https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059
	security-advisories@github.com	https://github.com/twisted/twisted/pull/12771
	security-advisories@github.com	https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
	security-advisories@github.com	https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "twisted",
          "vendor": "twisted",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.10.0rc1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1."
    }
  ],
  "id": "CVE-2026-115776",
  "lastModified": "2026-10-23T21:17:23.180",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-23T21:17:23.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/pull/12771"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-53XC-49M8-P798

Vulnerability from github – Published: 2026-10-23 20:45 – Updated: 2026-10-23 20:45

Summary

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Details

Summary

An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. twisted.words.protocols.irc.IRC.dataReceived appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because IRC is a plain Protocol and not a LineReceiver, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The twistd words server inherits the method unchanged through IRCUser, and the data is buffered before any authentication.

Details

IRC.dataReceived keeps everything up to the last line feed in self.buffer:

# twisted/words/protocols/irc.py
class IRC(protocol.Protocol):        # not a LineReceiver, so no MAX_LENGTH
    buffer = ""
    def dataReceived(self, data):
        if isinstance(data, bytes):
            data = data.decode("utf-8")
        lines = (self.buffer + data).split(LF)
        self.buffer = lines.pop()    # no 3line feed -> whole input stays buffered
        ...

With no line feed in the data, lines.pop() returns the entire accumulated content to self.buffer, so it grows by every chunk and is never bounded; IRC defines no MAX_LENGTH, no lineLengthExceeded, and no timeout, so the connection is never closed. The twistd words server protocol IRCUser subclasses IRC without overriding dataReceived, and the buffer is filled before any PASS, NICK, or USER, so no credentials are required.

Affected product: Twisted (twisted.words), twisted.words.protocols.irc.IRC and its subclass twisted.words.service.IRCUser Affected versions: 26.4.0 and earlier

PoC

On a standard Twisted words IRC server (the server twistd words runs, using IRCUser), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection's line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.

In a measured run against a real IRCFactory server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.

Impact

An unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole twistd words process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 26.4.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "Twisted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.10.0rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115776"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T20:45:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAn unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote client exhaust server memory. `twisted.words.protocols.irc.IRC.dataReceived` appends every received byte to a per-connection buffer and only removes data at a line feed, with no maximum length. Because `IRC` is a plain `Protocol` and not a `LineReceiver`, one connection that streams bytes without a line feed grows the buffer without bound and drives the whole single-threaded process to out-of-memory, dropping every user at once. The `twistd words` server inherits the method unchanged through `IRCUser`, and the data is buffered before any authentication.\n\n## Details\n\n`IRC.dataReceived` keeps everything up to the last line feed in `self.buffer`:\n\n```python\n# twisted/words/protocols/irc.py\nclass IRC(protocol.Protocol):        # not a LineReceiver, so no MAX_LENGTH\n    buffer = \"\"\n    def dataReceived(self, data):\n        if isinstance(data, bytes):\n            data = data.decode(\"utf-8\")\n        lines = (self.buffer + data).split(LF)\n        self.buffer = lines.pop()    # no 3line feed -\u003e whole input stays buffered\n        ...\n```\n\nWith no line feed in the data, `lines.pop()` returns the entire accumulated content to `self.buffer`, so it grows by every chunk and is never bounded; `IRC` defines no `MAX_LENGTH`, no `lineLengthExceeded`, and no timeout, so the connection is never closed. The `twistd words` server protocol `IRCUser` subclasses `IRC` without overriding `dataReceived`, and the buffer is filled before any `PASS`, `NICK`, or `USER`, so no credentials are required.\n\nAffected product: Twisted (`twisted.words`), `twisted.words.protocols.irc.IRC` and its subclass `twisted.words.service.IRCUser`\nAffected versions: 26.4.0 and earlier\n\n## PoC\n\nOn a standard Twisted words IRC server (the server `twistd words` runs, using `IRCUser`), an unauthenticated client opens a single TCP connection and continuously sends data that contains no line feed, never completing a line. Every chunk is appended to the connection\u0027s line buffer, and because no complete line is ever formed none of it is consumed, so the buffer grows by the full volume sent.\n\nIn a measured run against a real `IRCFactory` server, one unauthenticated connection sending 60 MB of line-feed-free data raised the server process resident memory from about 47 MB to 2966 MB (roughly 49 MB per MB sent) with the connection still open and no limit triggered. Sending the same volume as normal line-feed-terminated commands leaves memory flat, which isolates the cause to the missing line-length bound.\n\n## Impact\n\nAn unauthenticated remote denial of service from allocation without limits (CWE-770) leading to uncontrolled resource consumption (CWE-400). A single credential-free connection exhausts the memory of the whole `twistd words` process, and because one process serves every user, the crash drops all connections at once and the service stays down until it is restarted. The quadratic buffer copy reaches the same effect faster. There is no confidentiality or integrity impact and no code execution.",
  "id": "GHSA-53xc-49m8-p798",
  "modified": "2026-10-23T20:45:35Z",
  "published": "2026-10-23T20:45:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/pull/12771"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/twisted/twisted"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-115776 (GCVE-0-2026-115776)

FKIE_CVE-2026-115776

GHSA-53XC-49M8-P798

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour