CVE-2026-115776 in Twisted
Summary
by MITRE • 10/24/2026
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified within the Twisted framework affects its Internet Relay Chat protocol implementation, specifically targeting versions prior to 26.10.0rc1. Twisted serves as a foundational event-driven networking engine for Python applications, and its IRC module is widely utilized in chat servers and bots. The core technical flaw resides in the dataReceived method of the twisted.words.protocols.IRC class. This method is responsible for parsing incoming network traffic by splitting it into lines based on line feed characters. However, when a received byte sequence does not contain a complete line ending, Twisted retains these partial bytes in a per-connection buffer for subsequent processing upon arrival of more data. Crucially, this buffering mechanism lacks any enforcement of maximum line length limits or total connection memory caps prior to authentication completion.
This architectural oversight creates a significant resource exhaustion risk because the buffering occurs before critical authentication commands such as PASS, NICK, and USER are processed. In standard IRC protocol operations, these commands establish identity and session validity. Because Twisted buffers incoming data regardless of whether the client has successfully authenticated, an unauthenticated attacker can exploit this behavior by sending large blocks of non-terminated data to a target server connection. Since there is no upper bound on the size of the accumulated buffer for any single connection, the memory footprint associated with that specific socket increases continuously as more malicious data is received.
The operational impact of this flaw is severe, leading directly to Denial of Service conditions against IRC servers running affected versions of Twisted. As multiple unauthenticated connections engage in this behavior or even a single persistent connection floods the buffer, the server process consumes increasing amounts of system memory. Since many IRC deployments run on shared hosting environments or within resource-constrained containers, the exhaustion of available RAM can cause the entire server process to crash due to out-of-memory errors. This results in all connected users being dropped simultaneously, causing a complete service outage that requires manual intervention or restart to restore functionality.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption. The attack vector allows an attacker to trigger the condition without any prior authentication, classifying it as CWE-287, Improper Authentication, in terms of bypassing security checks before applying limits. In the context of the MITRE ATT&CK framework, this behavior is consistent with T1496, Resource Hijacking, where adversaries consume resources to disrupt availability or degrade performance for legitimate users. The lack of input validation and size constraints on network buffers prior to session establishment represents a fundamental design flaw in how connection state is managed during the initial handshake phase.
To mitigate this vulnerability, organizations must upgrade their Twisted dependencies to version 26.10.0rc1 or any later stable release where these limits have been implemented. For environments unable to immediately patch due to dependency conflicts, temporary mitigations include placing a reverse proxy in front of the IRC server that enforces strict connection timeouts and maximum payload sizes for unauthenticated sessions. Additionally, configuring operating-level resource controls such as cgroups on Linux can limit the memory footprint allowed per process or user, providing an additional layer of defense against total system exhaustion while patching efforts are underway. Regular auditing of third-party library versions is essential to prevent exposure to similar buffer management flaws in other network-facing components.