CVE-2026-115774 in Twisted
Summary
by MITRE • 10/24/2026
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox state. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating. The loop freezes the single-threaded reactor, stopping other IMAP connections and any SMTP or POP3 services hosted in the same process until restart. This issue is fixed in version 26.10.0rc1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Twisted versions prior to 26.10.0rc1 represents a critical denial of service condition stemming from improper input validation within the IMAP4 server implementation. Specifically, the flaw resides in the handling of literal sizes during authenticated SEARCH commands after the client has entered the selected mailbox state. When an attacker submits a command containing a negative literal size, the internal function twisted.mail.imap4.parseNestedParens processes this value without adequate bounds checking. This incorrect processing causes the parser cursor to move below zero, which triggers Python's specific behavior regarding negative indexing in sequences. Instead of raising an error or rejecting the malformed input as expected by secure coding standards, the interpreter interprets the negative index relative to the end of the sequence, leading to unexpected data access patterns that disrupt the normal flow of execution within the parsing logic.
The operational impact of this flaw is severe due to the architectural design of Twisted as an event-based framework operating on a single-threaded reactor model. The synchronous scanning loop responsible for processing the IMAP command fails to terminate because it relies on cursor position checks that are bypassed by the negative indexing behavior. Consequently, the main event loop becomes permanently blocked or frozen. Since Twisted typically handles multiple network connections within this same thread, the freezing of the parser prevents the reactor from servicing any other pending I/O operations. This results in a complete denial of service for all services hosted within that specific process instance, including not only IMAP but also SMTP and POP3 protocols if they are co-located in the same application server. The attack requires authentication, which limits its scope to authenticated users or compromised credentials, but once executed, it effectively halts mail processing capabilities until the service is manually restarted by an administrator.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-835 Loop with Unreachable Exit Condition (Infinite Loop). The failure to validate that literal sizes are non-negative before passing them to parsing routines allows for resource exhaustion through CPU starvation or memory access anomalies depending on the specific implementation details of the sequence traversal. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion via infinite loops or recursive calls that consume system resources and prevent legitimate service availability. The lack of input sanitization at the protocol parsing layer exemplifies a common weakness in network daemons where performance optimizations sometimes bypass rigorous security checks for edge cases like negative integers.
Mitigation strategies primarily involve upgrading to Twisted version 26.10.0rc1 or later, which includes patches that enforce strict validation on literal sizes and ensure the parser cursor remains within valid bounds. For environments where immediate patching is not feasible, network-level controls such as firewalls or intrusion prevention systems can be configured to inspect IMAP traffic for malformed SEARCH commands with negative literals, although deep packet inspection may impact performance. Additionally, implementing application-layer gateways that validate command syntax before forwarding requests to the backend server can provide an additional layer of defense. Developers should also review other areas of the codebase where user-supplied integers are used in indexing or loop control logic to prevent similar vulnerabilities from arising through different input vectors. Regular security audits focusing on input validation and state machine transitions in protocol parsers are essential for maintaining the integrity of event-driven network services.