High severity · published Oct 23, 2026
CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
New
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
twisted · twisted
< 26.10.0rc1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115776
github.com
https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30
github.com
https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059
github.com
https://github.com/twisted/twisted/pull/12771
github.com
https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
github.com
https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798
More from twisted
9.8
CVE-2020-10109
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
9.8
CVE-2020-10108
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
8.7
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
8.1
CVE-2022-24801
Twisted is an event-based framework for internet applications, supporting Python 3.6+
7.5
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer