Twisted: Unauthenticated remote memory exhaustion in domish XML stream (CVE-2026-115775)

Twisted contains a vulnerability in twisted.words.xish.domish where an unauthenticated remote peer can exhaust server memory through a specifically crafted, unclosed XML element tree. The ExpatElementStream parser fails to implement depth or child-count limits during XML streaming. By sending a container element and continuously streaming child elements without an end tag, an attacker forces the server to materialize every element in memory, retaining the entire tree until the process reaches memory limits and is terminated. This exploitation occurs during initial protocol negotiation, such as XMPP, before any authentication takes place.

Impact

Successful exploitation results in a remote denial of service via memory exhaustion, causing the host process to be terminated by the operating system. There is no impact on confidentiality or integrity, and no potential for remote code execution.

Recommendation

• Upgrade the Twisted package to the latest version once a fix is released.
• Implement pre-authentication XML stream size and duration limits at the application or load balancer layer for all services utilizing twisted.words.xish.domish for untrusted input.
• Monitor application memory metrics for anomalous, sustained growth during the connection negotiation phase for XMPP services.