High severity · published Oct 23, 2026
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
New
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
twisted · twisted
< 26.10.0rc1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115778
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115778
github.com
https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529
github.com
https://github.com/twisted/twisted/commit/5d91cc66a3591faba758a80a1479e0103602facc
github.com
https://github.com/twisted/twisted/pull/12750
github.com
https://github.com/twisted/twisted/releases/tag/twisted-26.10.0rc1
github.com
https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr
More from twisted
9.8
CVE-2020-10109
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
9.8
CVE-2020-10108
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability
8.7
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
8.1
CVE-2022-24801
Twisted is an event-based framework for internet applications, supporting Python 3.6+
7.5
CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer