◆ CVE Hub

CVE-2026-115775

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Published
2026-10-23
Last modified
2026-10-23
CNA
GitHub_M
NVD status
Received
CWE
CWE-400 CWE-770

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
8.7
HIGH
Scored by github.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
8.7
HIGH
Scored by CNA (GitHub_M) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS exploit probability
0.7%
Percentile 50.9%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 4.0 vector
NetworkNo authNo interaction Confidentiality NIntegrity NAvailability H

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Attack requirements ATNNone
Privileges required PRNNone
User interaction UINNone
Confidentiality (vulnerable system) VCNNone
Integrity (vulnerable system) VINNone
Availability (vulnerable system) VAHHigh
Confidentiality (subsequent systems) SCNNone
Integrity (subsequent systems) SINNone
Availability (subsequent systems) SANNone
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

NVD

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)4.08.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA / GitHub_M4.08.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
twistedtwisted
affected: < 26.10.0rc1

Open-source packages (GitHub Advisory / OSV)

GHSA-3476-c5c2-fr73 GHSA HIGH reviewed

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

EcosystemPackageAffected versionsFixed in
PyPITwisted<= 26.4.026.10.0rc1

Linux distribution status

Red Hat ↗ important

ReleasePackageStatusFixed version / notes
Red Hat Ansible Automation Platform 2ansible-automation-platform-24/controller-rhel8fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-25/controller-rhel8fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-25/lightspeed-rhel8fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/controller-rhel9affected
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/eda-controller-rhel9affected
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/lightspeed-rhel9affected
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/controller-rhel9affected
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/eda-controller-rhel9affected
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/lightspeed-rhel9affected
Red Hat Ansible Automation Platform 2automation-controlleraffected
Red Hat Ansible Automation Platform 2python-twistedfix deferred
Red Hat OpenStack Platform 16.2python-twistedaffected
Red Hat Ansible Automation Platform 2python3.11-twistedaffected
Red Hat Ansible Automation Platform 2python3.12-twistedaffected
Red Hat Ansible Automation Platform 2python3x-twistedfix deferred

Debian ↗

ReleasePackageStatusFixed version / notes
bookwormtwistedopen not yet assigned
forkytwistedopen not yet assigned
sidtwistedopen not yet assigned
trixietwistedopen not yet assigned no-dsa: Minor issue

Ubuntu ↗ Fetching

References (5)