Patch Forecast
Amber warning
Patch this week.

CVE-2026-115775 · GHSA-3476-c5c2-fr73

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Risk score
72/100
CVSS
8.7 v4.0
Exploit chance (30 days)
0.7%
Published
23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Twisted has a vulnerability in its XML parser that allows an unauthenticated remote peer to cause a denial of service by continuously adding child elements to an in-memory tree, exhausting server memory and terminating the process.
Affected
{'products': ['Twisted'], 'packages': ['Twisted'], 'versions': ['<= 26.4.0']}
Fix
Upgrade to version 26.10.0rc1 or later
Exploitation
No known exploitation

Story map

Story map: TwistedTHE FLAWSTHE FIXCVE-2026-115775Unauthenticated Remote Denialof Service in the Twistedwords domish XML Element…CVSS 8.7 · EPSS 1%CVE-2026-115776Unauthenticated Remote Denialof Service in the Twisted IRCServer via an Unbounded Line…CVSS 7.5 · EPSS 1%CVE-2026-115778Unauthenticated Remote Denialof Service in the Twisted conchTelnet Transport via an…CVSS 7.5 · EPSS 1%CVE-2026-115774Denial of Service in theTwisted IMAP4 Server via aNegative Literal Size in…CVSS 4.9 · EPSS 1%Upgrade Twisted26.10.0or later on your release lineWho is exposed{'products': ['Twisted'],'packages': ['Twisted'],'versions': ['<= 26.4.0']}AMBER · PATCH THIS WEEKTwistedTwisted has a vulnerability in itsXML parser that allows anunauthenticated remote peer tocause a denial of service bycontinuously adding childelements to an in-memory tree,exhausting server memory and…Where it standsNo known exploitationCONNECTS TOSame weaknessDenial of service (CWE-400)254 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Twisted: Amber, patch this week. Twisted has a vulnerability in its XML parser that allows an unauthenticated remote peer to cause a denial of service by continuously adding child elements to an in-memory tree, exhausting server memory and terminating the process.

The flaws

  • CVE-2026-115775: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (CVSS 8.7 · EPSS 1%)
  • CVE-2026-115776: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (CVSS 7.5 · EPSS 1%)
  • CVE-2026-115778: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (CVSS 7.5 · EPSS 1%)
  • CVE-2026-115774: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (CVSS 4.9 · EPSS 1%)

The fix

Upgrade Twisted: 26.10.0 or later on your release line

Who is exposed: {'products': ['Twisted'], 'packages': ['Twisted'], 'versions': ['<= 26.4.0']}

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.7 high
  • Remotely exploitable without logging in
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
Twistedpip<= 26.4.026.10.0rc1

References

Original description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

Last activity 23 Oct 2026. Patch Forecast updates every hour.