Twisted up to 26.9.x ExpatElementStream parser twisted.words.xish.domish resource consumption

Summaryinfo

A vulnerability has been found in Twisted up to 26.9.x and classified as problematic. This issue affects some unknown processing of the file twisted.words.xish.domish of the component ExpatElementStream parser. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-115775. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Twisted up to 26.9.x. It has been rated as problematic. This issue affects an unknown part of the file twisted.words.xish.domish of the component ExpatElementStream parser. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-115775 since 10/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 26.10.0rc1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Twisted

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5
• 26.6
• 26.7
• 26.8
• 26.9

Website

• Product: https://github.com/twisted/twisted/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion