Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Low | 3.1 | CVE-2026-83813 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-83813Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory describes a fix in the Twisted framework's DNS code, in which DNS responses were not checked against the address that sent the original query. The advisory does not state a severity rating for this issue. The text provided contains only a code diff, so the vendor's recommended action beyond the code change is not stated. Technical summaryThe change touches the DNSDatagramProtocol class in src/twisted/names/dns.py and adds a per-message-ID record of the query's destination address. Incoming datagrams whose message ID matches a live query are now dropped unless the source address matches the stored address. This suggests the earlier weakness was a missing source-address check on DNS responses, which would be a spoofing or response-injection class issue, but the advisory does not explicitly name the vulnerability class. Attack vector, preconditions, and the affected version range are not stated. The fixed release version is not stated. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/b53e1…1c74cf9e48373b5879ac Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.4 | CVE-2026-115877 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-115877Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory describes a request-smuggling gap in the Twisted web framework's HTTP header parsing, where a header value containing a bare carriage return or line feed could hide a following header from the parser. The advisory does not state a severity rating. The fix, as shown in the diff, makes the server reject such header values with a 400 response and close the connection. Technical summaryThe flaw is a request-smuggling issue in twisted.web.http.HTTPChannel.headerReceived, which accepted header values containing bare CR or LF characters that a lenient proxy could interpret differently. The diff adds a check that rejects header values containing NUL, CR, or LF with a 400 Bad Request and disconnects, citing RFC 9110 section 5.5. The advisory does not state affected version ranges, fixed version numbers, workarounds, exploitation status, or a CVSS score. Detection guidance is not stated, though the added test sends bare CR and LF header values and expects a 400 response. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/1616f…a5b22ad70fab140a7eb1 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.5 | CVE-2026-115778 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-115778Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory covers a Twisted Telnet protocol issue where a remote peer could send a telnet subnegotiation that is never terminated, causing the server to buffer data without limit and potentially exhaust its memory. The fix caps the buffer and drops the connection when the cap is exceeded. The advisory text provided does not state a severity rating or CVSS score. Technical summaryThe flaw is an unbounded memory buffer (resource exhaustion) in twisted.conch.telnet.Telnet when parsing an unterminated IAC SB subnegotiation, as described in the changed code and newsfragment. The fix adds a _MAX_SUBNEGOTIATION_LENGTH cap of 4096 bytes, logs a warning, and drops the connection when the cap is exceeded, with escaped IAC IAC bytes counting toward the cap. The advisory does not state affected version ranges or a fixed release version, and does not state a CVSS score, exploitation status, or workaround. No detection guidance beyond the logged warning text is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/073ba…1abc5ae76d46eff1b529 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.5 | CVE-2026-115776 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-115776Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory describes a fix in the Twisted Python networking framework's IRC protocol component, where a remote peer could exhaust server memory by sending data without a line delimiter. The advisory does not state a severity rating or a CVSS score. The fix adds a maximum line length that drops the connection when exceeded, and the advisory points to upgrading to the patched release. Technical summaryThe weakness is unbounded buffer growth in twisted.words.protocols.irc.IRC, where data without a line delimiter accumulates in memory, which is a resource exhaustion issue. A remote peer that can connect to the IRC protocol and send data without a newline can trigger it, and the advisory does not state other preconditions. The fix adds a MAX_LENGTH class attribute with a default of 16384 and calls lineLengthExceeded, which drops the connection by default. The advisory does not state affected or fixed version numbers, does not give a workaround, and does not provide detection guidance. The advisory text is a diff and does not state these items explicitly. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/01f8c…380b2ea939fa6bdbab30 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-115775 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-115775Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory describes a change to the Twisted Python networking framework's XML stream parser in twisted.words, used for XMPP messaging, which previously let a peer exhaust server memory by sending an unbounded stanza. The fix adds per-stanza size and element-count limits. The advisory does not state a severity rating or CVSS score, and it does not give affected or fixed version numbers. Technical summaryThe weakness is unbounded resource consumption (memory exhaustion) in the domish XML element streams of twisted.words.xish, which parse XMPP stanzas from a peer. The advisory's diff adds maxStanzaSize and maxElementCount limits to SuxElementStream and ExpatElementStream, raising ParserError when exceeded, with counters reset when a stanza is emitted. The attack vector is a remote peer sending a large or unbounded stanza; no authentication requirement is stated. Affected and fixed version numbers are not stated, and no workaround is stated. Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/88738…ad4d2c4d64039beb88b0 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.9 | CVE-2026-115774 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-115774Twisted is an event-based framework for internet applications, supporting Python 3.6+
Executive summaryThe advisory describes a flaw in the Twisted framework's IMAP mail server component, where an authenticated client could send a crafted SEARCH command that freezes the server. The advisory does not state a severity rating or CVSS score. The fix rejects literals with a negative octet count, and the advisory gives no workaround beyond applying the code change. Technical summaryThe flaw is a denial-of-service condition in the parseNestedParens function of twisted.mail.imap4, where a literal with a negative octet count causes the parser to loop without terminating. The attacker must be an authenticated IMAP client sending a crafted SEARCH command. The fix adds a check that raises ValueError with the message "Illegal literal size" when the literal size is less than zero, and a unit test named test_literalNegativeSize was added. The advisory does not state affected version numbers, fixed version numbers, a CVSS score, or any workaround. Exploitation in the wild and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/3d125…97f480bb699a5e074741 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 4.3 | CVE-2026-106454 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+
twistedtwisted
|
NVD | |||
|
CVE-2026-106454Twisted is an event-based framework for internet applications, supporting Python 3.6+
From the advisoryTwisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||