Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-115774Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Medium 4.9

In plain English

A medium-severity uncontrolled resource consumption in twisted from twisted. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.5%top 55.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12twistedno fix listedDEBIAN-CVE-2026-115774
Debian:13twistedno fix listedDEBIAN-CVE-2026-115774
Debian:14twisted26.10.0-1DEBIAN-CVE-2026-115774
PyPItwisted26.10.0rc1GHSA-2qrf-pqgx-qh9v
Ubuntu:22.04:LTStwistedno fix listedUBUNTU-CVE-2026-115774
Ubuntu:24.04:LTStwistedno fix listedUBUNTU-CVE-2026-115774
Ubuntu:26.04:LTStwistedno fix listedUBUNTU-CVE-2026-115774
Ubuntu:26.10twistedno fix listedUBUNTU-CVE-2026-115774

Affected products (as reported)

VendorProductVersions
twisted twisted < 26.10.0rc1

Weakness: CWE-400, CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References