Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115775— Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Quick assessment

Affected
twisted twisted
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Twisted 是一个面向互联网应用的事件驱动框架，支持 Python 3.6 及以上版本。在 26.10.0rc1 之前的版本中， 模块的 解析器允许未经身份验证的远程对等方在持续添加子元素的同时，保持一个容器元素处于未关闭状态。该解析器会将未完成的语段（stanza）以内存树的形式保留，且未对字节数或元素数量设置任何限制。此外，XMPP 在身份验证之前的流解析阶段即暴露了此行为，即在接收并验证凭据之前便已处理相关数据。因此，单个连接即可耗尽服务器内存，导致进程终止。该问题已在版本 26.10.0rc1 中修复。

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115775

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Source: CVE Program / CVE List V5
Vulnerability Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
twisted twisted < 26.10.0rc1 -

II. Public POCs for CVE-2026-115775

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115775

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115775 (2)

Vendor Advisories for CVE-2026-115775 (1)

Vendor Pages for CVE-2026-115775 (1)

Same Patch Batch · twisted · 2026-10-23 · 6 CVEs total

CVE-2026-115776 7.5 HIGH Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbound
CVE-2026-115778 7.5 HIGH Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport vi
CVE-2026-115877 5.4 MEDIUM Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
CVE-2026-115774 4.9 MEDIUM Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEAR
CVE-2026-83813 3.1 LOW Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

IV. Related Vulnerabilities

Same product: twisted
Same vendor: twisted
Same weakness: CWE-400

V. Comments for CVE-2026-115775

No comments yet

Leave a comment