Twisted: Memory exhaustion denial-of-service in Telnet implementation (CVE-2026-115778)

Twisted versions prior to 26.10.0rc1 are vulnerable to a memory exhaustion denial-of-service attack. The vulnerability exists within twisted.conch.telnet.Telnet.dataReceived, which fails to enforce a maximum length on the subnegotiation buffer when processing data following an IAC SB (Interpret As Command Subnegotiation Begin) signal. Because this Telnet option negotiation occurs prior to authentication, an unauthenticated remote attacker can continuously send data bytes without the required IAC SE (Interpret As Command Subnegotiation End) terminator. This causes the buffer to grow until the application process exhausts memory and terminates, affecting all services hosted by that Twisted instance.

Impact

Successful exploitation results in a process-wide crash, causing a denial-of-service for the affected application and all services managed by that specific Twisted process.

Recommendation

• Upgrade Twisted to version 26.10.0rc1 or later immediately.
• If patching is not feasible, implement network-level controls to restrict access to services running the Twisted Telnet implementation to trusted IP ranges.
• Monitor network traffic directed at Twisted-based services for unusually long or high-frequency Telnet option negotiation sequences.