CVE-2026-115776

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-115776

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115776.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-115776

Aliases

GHSA-53xc-49m8-p798

Downstream

Published

2026-10-23T20:18:38Z

Modified

2026-10-25T02:45:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Details

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115776.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "26.10.0rc1"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "3.6+"
                        },
                        {
                            "fixed":  "26.10.0rc1"
                        },
                        {
                            "fixed":  "26.10.0rc1"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/twisted/twisted

Affected ranges

Type

GIT

Repo

https://github.com/twisted/twisted

Events

Introduced

Fixed

01f8cff7753c1edac132380b2ea939fa6bdbab30

Fixed

ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059

Fixed

875d118c9a82a4f55a92ff399bd31f8928a52ad3

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "01f8cff7753c1edac132380b2ea939fa6bdbab30"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "twisted-26.10.0rc1",
            "range":  [
                {
                    "fixed":  "875d118c9a82a4f55a92ff399bd31f8928a52ad3"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

before-black

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115776.json"