Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-115776: Twisted IRC server can be crashed by unauthenticated user
CVE-2026-115776 · published 12 days ago
Summary
The Twisted Python library’s IRC component accepts data from a new connection without limiting how much it stores before the user logs in. An attacker can send endless data, fill the server’s memory, and cause the service to stop working for everyone. Upgrade to Twisted version 26.10.0rc1 or later to apply the fix.
What to do
- Update twisted matrix community twisted to version 26.10.0rc1.
- Update twisted to version 26.10.0rc1.
- Update debian twisted to version 26.10.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | twisted matrix community | twisted |
<= 26.4.0 Fix: upgrade to 26.10.0rc1
|
| – | twisted | twisted | < 26.10.0rc1 |
| pip | – | twisted |
<= 26.4.0 Fix: upgrade to 26.10.0rc1
|
| Debian:12 | debian | twisted | All versions |
| Debian:14 | debian | twisted |
< 26.10.0-1 Fix: upgrade to 26.10.0-1
|
| Ubuntu:Pro:14.04:LTS | canonical | twisted | All versions |
Original advisory text
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.
References
- https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798 Third Party Advisory
- https://github.com/advisories/GHSA-53xc-49m8-p798
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-1157... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-115776 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-115776 Vendor Advisory
- https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1 Third Party Advisory
- https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab... Third Party Advisory
- https://github.com/twisted/twisted/pull/12771 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-115776 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-115776 Third Party Advisory
- https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca30... Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published23 Oct 2026
Updated4 Nov 2026
First seen23 Oct 2026
Sources
CVE-2026-115776 · NVD
CVE-2026-115776 · MITRE
GHSA-53xc-49m8-p798 · GHSA
CVE-2026-115776 · OSV
DEBIAN-CVE-2026-115776 · OSV
UBUNTU-CVE-2026-115776 · OSV
Track software like this
Free during beta